LayerZero Attributes $290 Million Kelp Exploit to Inadequate Security Setup and North Korea's Lazarus Group

LayerZero has attributed the $290 million exploit of Kelp DAO to the protocol's security configuration, specifically its use of a single-verifier setup despite recommendations for a multi-verifier approach. The attack, which LayerZero believes with preliminary confidence was perpetrated by North Korea's Lazarus Group and its TraderTraitor subunit, exploited the infrastructure layer rather than protocol code. The attackers compromised two remote procedure call (RPC) nodes used by LayerZero's verifier for cross-chain transactions, replacing the binary software with malicious versions that reported fraudulent transactions to LayerZero's verifier while providing accurate data to other systems. To ensure the attack went undetected by LayerZero's monitoring infrastructure, the attackers conducted a distributed denial-of-service (DDoS) attack on uncompromised external RPC nodes, forcing failover to the compromised nodes. This DDoS attack occurred between 10:20 a.m. and 11:40 a.m. Pacific Time on Saturday, resulting in Kelp's bridge releasing 116,500 rsETH to the attackers. Following the incident, LayerZero's verifier was taken offline and has since been restored, with the company announcing it will no longer support applications with single-verifier configurations, thus prompting a protocol-wide migration to multi-verifier setups. The distinction between a protocol-level bug and a configuration failure is significant for DeFi's assessment of LayerZero risk. Given that the attack was the result of Kelp's security choices rather than a flaw in LayerZero's code, the company has confirmed no contagion to other applications on the protocol, with all OFT-standard tokens and applications using multi-verifier setups remaining unaffected. The Lazarus Group has been linked to two major exploits in 18 days, including the Drift Protocol exploit on April 1, collectively draining over $575 million from DeFi through distinct attack vectors.