LayerZero Labs released its incident report on the KelpDAO bridge exploit, confirming that ~116,500 rsETH worth roughly $292 million was stolen. Rather than attacking the LayerZero protocol directly, the attackers compromised downstream RPC infrastructure used by the verification network, then forged transaction data to trick the verifier into confirming fake cross-chain messages.
Exploit isolated to single-verifier configuration
LayerZero stressed that the incident was limited to KelpDAO's rsETH bridge, which used a 1-of-1 DVN configuration where LayerZero Labs served as the sole verifier. The company had long recommended that applications adopt diversified multi-DVN setups with redundancy. It stated there was zero contagion to other cross-chain assets or applications, arguing that the modular security architecture contained the blast radius even though a single application-level configuration failed.
Attack flow: RPC poisoning plus DDoS trigger
According to the report, the April 18, 2026 attack unfolded in three steps: First, the attackers gained access to the list of RPC endpoints used by the LayerZero Labs DVN, then compromised two nodes on separate clusters and replaced binaries on op-geth nodes. Next, malicious payloads fed forged transaction data to the verifier while returning truthful data to other endpoints, including internal monitoring services. Finally, attackers launched DDoS attacks on uncompromised RPC endpoints, triggering failover toward the poisoned nodes. The LayerZero Labs DVN then confirmed transactions that had never actually occurred.
External forensics broadly matched that description. Chainalysis linked the exploit to North Korea's Lazarus Group, specifically TraderTraitor, and noted that the attack did not exploit a smart contract bug but rather forged a cross-chain message by poisoning internal RPC nodes in a single-point-of-failure verification setup.
Security changes: no more signing for 1/1 configs
LayerZero's immediate response included deprecating and replacing all affected RPC nodes, restoring the Labs DVN to operation, contacting law enforcement, and working with Seal911 and industry partners to trace stolen funds. More importantly, the company announced a policy shift: its DVN will not sign or attest messages from any application using a 1/1 configuration. This direct change aims to prevent a repeat of the KelpDAO failure mode.
LayerZero is also contacting projects still using single-verifier setups to migrate them to multi-DVN models with redundancy, admitting that configuration flexibility without enforced safety rails was too permissive. Nexus Mutual reported that the forged message drained $292 million from the KelpDAO bridge in under 46 minutes, making it one of 2026's largest DeFi losses.
The incident delivers a brutal yet familiar lesson: smart contracts can survive intact while the protocol still fails in practice if the off-chain trust layer is weak. LayerZero now argues that the real mistake was not that modular security failed, but that letting anyone run a single-signer setup was too dangerous.