Cross-chain protocol LayerZero released a detailed post-mortem of the April 18 rsETH bridge exploit in collaboration with Mandiant and CrowdStrike. The attacker drained 116,500 rsETH from KelpDAO's staking pool, worth approximately $292 million at the time. The investigation linked the attack to TraderTraitor (also tracked as UNC4899), a DPRK-linked threat actor.
Attack chain: from phishing email to forged cross-chain transaction
The breach began on March 6, when the attacker socially engineered a LayerZero Labs developer to steal session keys and entered LayerZero's RPC cloud environment. Inside the internal network, the threat actor deployed malicious software into RPC node memory — nodes responsible for processing blockchain state requests across networks. Compromised nodes returned legitimate responses to monitoring tools but sent manipulated data to LayerZero Labs' Decentralized Verifier Networks (DVNs).
To expand the attack, the hacker launched a Denial of Service assault against an external RPC provider. LayerZero Labs' signing service was forced to rely on two internal nodes that had been compromised. Mandiant, CrowdStrike, and independent researchers confirmed that a forged message later received a valid attestation, leading the KelpDAO rsETH bridge to release assets.
Single-verifier configuration became the fatal flaw
LayerZero stated that the affected OApp relied on a single-verifier configuration at the time of the incident. No second independent DVN reviewed the forged message. The destination contract accepted the single attestation and unlocked rsETH. LayerZero emphasized that no other OApps, channels, or transactions were compromised.
Remediation: cloud environment replaced, single-verifier mode abolished
Following the exploit, LayerZero changed how its DVN system handles channel security requirements. The company said its DVN will no longer sign as the sole required attestor. LayerZero replaced the affected cloud environment entirely, rebuilding infrastructure with hardened configurations and removing legacy credentials. Short-lived credentials and multi-person approval requirements for administrative changes were introduced, along with device and session validation checks. LayerZero noted that CrowdStrike, Mandiant, and zeroShadow continue to support the investigation alongside law enforcement.