TLDR
LayerZero is tightening its bridge security after a KelpDAO exploit drained about $292 million in rsETH through a weak verifier configuration.
- The attacker compromised infrastructure behind a single-verifier LayerZero setup for KelpDAOs rsETH bridge, stealing roughly 116,500 rsETH worth about $292 million.
- LayerZero is now banning single-signer DVN setups and raising default verifier requirements to multi-signer configurations to remove that single point of failure.
- A parallel flight to safety is pushing billions in bridged assets from LayerZero to Chainlink CCIP, reshaping cross chain risk choices for DeFi projects.
Deep Dive
1. What Actually Happened
According to LayerZeros incident report, attackers stole about 116,500 rsETH, worth roughly $292 million, from KelpDAOs LayerZero powered bridge by poisoning RPC infrastructure that fed its verifier network configuration for rsETH. The exploited setup used a 1-of-1 Decentralized Verifier Network (DVN), with LayerZero Labs as the sole verifier, which allowed the compromised infrastructure to approve fraudulent messages and drain funds in under an hour. Investigators including Mandiant and CrowdStrike linked the operation to North Korea associated TraderTraitor, and LayerZero framed the incident as an infrastructure compromise rather than a core protocol bug in its incident analysis.
The core failure was a centralized trust layer around a single verifier, not the basic message passing design, so configuration choices became the attack surface.
2. How LayerZero Is Tightening Security
In its postmortem, LayerZero said it will no longer sign or attest messages for applications using 1-of-1 DVN configurations and is pushing integrators to multi DVN redundancy for cross chain verification. Follow up coverage notes that LayerZero has removed support for single verifier DVNs entirely and is shifting defaults to stricter multi signer setups, with reports citing targets like 3 of 3 and even 5 of 5 verifier networks in some routes. The firm also rebuilt affected RPC infrastructure and cloud environments and is developing an updated DVN client, aiming to harden the off chain components that were abused.
If you use a LayerZero based bridge, the main practical change is that you should see multi verifier security stacks by default instead of single verifier shortcuts.
3. Industry Response And What To Watch
The exploit has triggered a broader migration of value away from LayerZero based bridges to Chainlinks Cross Chain Interoperability Protocol, with Lombard, KelpDAO, Solv, Re.xyz, Kraken and others collectively moving over $3 to $4 billion in assets according to multiple reports. These projects cite Chainlink CCIPs defense in depth design, including 16 independent node operators and formal ISO 27001 plus SOC 2 Type 2 certifications, as reasons to switch. For users, risk now concentrates in fewer, larger bridge providers, so key things to watch are whether remaining LayerZero apps quickly adopt stronger DVN configurations and whether CCIP can avoid its own single point of failure patterns as its TVL grows.
Cross chain risk is shifting, not disappearing, and due diligence now needs to focus on each bridges verifier topology and operational controls, not just its brand.
Conclusion
A $292 million exploit on a single verifier LayerZero configuration has forced LayerZero to harden its DVN policies and catalyzed a major rotation of liquidity toward Chainlinks CCIP. For crypto users and protocols, the key change is that verifier design and off chain operational security are now central to bridge selection, and monitoring how quickly integrators adopt multi verifier, rate limited setups will be critical to managing cross chain risk.
CoinsKid.Com