LayerZero Attributes $290 Million Kelp DAO Exploit to Inadequate Security Setup and North Korea's Lazarus Group

LayerZero has attributed the $290 million Kelp DAO exploit to a security configuration flaw on Kelp's part, specifically the use of a single-verifier setup despite prior warnings. The attack, which LayerZero believes with preliminary confidence was carried out by North Korea's Lazarus Group and its TraderTraitor subunit, exploited a novel vector targeting the infrastructure layer. The perpetrators compromised two remote procedure call (RPC) nodes used by LayerZero's verifier for cross-chain transactions, replacing the binary software with malicious versions that misled the verifier into confirming a fraudulent transaction while reporting accurate data to other systems. To ensure the attack remained undetected, the attackers also launched a distributed denial-of-service (DDoS) attack on uncompromised external RPC nodes, forcing a failover to the compromised ones. Traffic logs show the DDoS occurred between 10:20 a.m. and 11:40 a.m. Pacific Time on Saturday, resulting in the release of 116,500 rsETH to the attackers. The attack's success was facilitated by Kelp's 1-of-1 verifier configuration, contrary to LayerZero's recommendations for a multi-verifier setup with redundancy. LayerZero has confirmed that no other applications on the protocol were affected and has since brought its verifier back online, announcing that it will no longer support applications with single-verifier configurations. The distinction between a protocol-level bug and a configuration failure is significant for DeFi's risk assessment of LayerZero going forward. Meanwhile, Kelp has not publicly responded to LayerZero's account of the exploit or explained its decision to operate a 1-of-1 verifier setup despite explicit warnings. The Lazarus Group, linked to both the Kelp and Drift Protocol exploits, has drained over $575 million from DeFi in 18 days, demonstrating its ability to adapt its tactics faster than DeFi protocols can strengthen their defenses.