LayerZero Attributes $290 Million Exploit to Kelp's Security Setup and North Korea's Lazarus Group

LayerZero has attributed the $290 million Kelp DAO exploit to Kelp's own security configuration, stating that the liquid restaking protocol's use of a single-verifier setup, despite warnings against it, was the primary cause of the vulnerability. The attack, which LayerZero believes with preliminary confidence was carried out by North Korea's Lazarus Group and its TraderTraitor subunit, exploited a novel vector targeting the infrastructure layer. The attackers compromised two remote procedure call (RPC) nodes that LayerZero's verifier relied on for cross-chain transactions, swapping the binary software with malicious versions designed to deceive LayerZero's verifier into confirming a fraudulent transaction. To maintain the attack's stealth, the compromised nodes continued to report accurate data to other systems querying them, while the attackers launched a distributed denial-of-service attack on uncompromised external RPC nodes to force failover to the compromised ones. LayerZero's traffic logs show the DDoS occurred between 10:20 a.m. and 11:40 a.m. Pacific Time on Saturday, resulting in the release of 116,500 rsETH to the attackers once the failover was triggered. The attack's success was contingent upon Kelp's 1-of-1 verifier configuration, which LayerZero had recommended against in favor of a multi-verifier setup with redundancy. Such a setup would have required consensus across several independent verifiers to confirm a message, thereby preventing the attack. LayerZero has confirmed that there was no contagion to other applications on the protocol and has reinstated its verifier, announcing that it will no longer sign messages for applications using single-verifier configurations. This incident highlights the importance of configuration choices in DeFi security and the evolving tactics of groups like Lazarus, which has been linked to over $575 million in DeFi losses through two distinct attack vectors in 18 days.