TLDR
LayerZero has admitted it made a serious configuration and communication error in the $292 million KelpDAO rsETH exploit.
- The hack abused a single-verifier setup and poisoned RPC data, letting attackers linked to Lazarus drain roughly $292 million in rsETH collateral.
- LayerZero now accepts fault for allowing risky 1 of 1 verifier configurations and for initially shifting blame onto KelpDAO.
- The incident is driving migrations to alternative bridge providers and forcing LayerZero to harden DVN quorums, multisig security, and monitoring.
Deep Dive
1. Exploit Mechanics And Attribution
Reports say the April exploit targeted KelpDAOs rsETH bridge, using unbacked rsETH as collateral on Aave to pull out about $230 million in ETH, with the total impact around $292 million in value. Coverage attributes the operation to North Koreas Lazarus Group, which allegedly poisoned LayerZeros internal RPC infrastructure while launching a DDoS attack on external RPC providers, causing its Decentralized Verifier Network (DVN) to accept bad data and approve fraudulent transactions. LayerZero stresses its core protocol code was not directly hacked, but acknowledges that using its own DVN as a single verifier created a single point of failure for high value flows.
Confidence: high because multiple independent outlets report consistent technical details and quotes from LayerZeros statement.
2. LayerZero's Admission And Fallout
After weeks of arguing that KelpDAO chose the dangerous 1 of 1 configuration and that the system functioned as intended, LayerZero has now publicly apologized and said we made a mistake in allowing its DVN to secure high value assets in that setup, accepting responsibility for not policing what our DVN was securing and for communication failures. Analyses note that nearly half of active LayerZero OApp contracts reportedly used similar single verifier DVNs at the time, suggesting this was a systemic design and governance issue, not a one off misconfiguration. In the aftermath, major users such as KelpDAO and Solv Protocol have moved cross chain infrastructure to Chainlinks CCIP, and a broader DeFi recovery effort (DeFi United) has coordinated over $300 million in contributions and legal steps to recapitalize affected positions.
Bridge risk is not just about smart contract audits, but also about how many independent verifiers and infrastructure providers secure your assets.
3. Security Changes And What To Watch
LayerZero says it will no longer support 1 of 1 DVN setups, is migrating defaults to 5 of 5 verifiers where possible and at least 3 of 3 on smaller networks, and is building a second DVN client in Rust with stronger RPC quorum controls. The team also disclosed an older multisig lapse, and is now moving from a 3 of 5 to a 7 of 10 signing threshold using its custom OneSig system, plus launching a Console product so asset issuers can manage security settings and monitor anomalies more directly. On the ecosystem side, courts have begun clearing paths for recovered ETH held on Arbitrum to flow back to Aave and rsETH users, but ongoing litigation tied to North Korea terror judgments means legal risk around seized funds has not fully cleared.
For users and protocols, the key signals are whether LayerZeros new quorum rules are actually enforced in production and whether large projects continue to migrate to alternative cross chain stacks.
Conclusion
LayerZeros admission turns the KelpDAO exploit from a user misconfiguration story into a case study in how validator quorums, RPC design, and governance choices can create systemic bridge risk. The immediate damage is being addressed by DeFi coalitions and courts, but the longer term impact is a shift in capital and trust toward providers that can prove conservative security defaults, multi party verification, and transparent incident handling.
CoinsKid.Com