LayerZero says North Korea's Lazarus is likely behind the $292M Kelp DAO exploit on April 18, which triggered $10B in outflows from Aave over bad debt concerns

Quick Take — LayerZero said North Korean hacker group Lazarus is likely responsible for the $292 million Kelp DAO exploit.

The Block 2026-04-20 Danny Park

Discussion

NullTX Will Izuchukwu on x
LayerZero Blames KelpDAO for $290 Million Hack, Citing Possible Links With DPRK's Lazarus Group
@layerzero_core @layerzero_core on x
KelpDAO Incident Statement
@banteg @banteg on x
such elaborate distancing doesn't sit well with me. it literally says “the protocol functioned exactly as intended”. the attack is described as a compromise of an rpc node and rpc poisoning. but that's not what rpc poisoning means, their own infra was breached and compromised.
@donnoh_eth @donnoh_eth on x
key takeaway from the article: the LayerZero protocol, *when used as intended*, is not safe. i'd add, the protocol is certainly safe when it is intended not to use it in the first place [image]
@suhailkakar Suhail Kakar on x
the kelp rsETH post-mortem is wild lazarus (dprk) compromised two rpc nodes that layerzero dvn was relying on. swapped the op-geth binaries. wrote a custom payload that forged messages *only when the dvn queried* - every other IP, including monitoring, saw clean truthful data. [i…
@hosseeb Haseeb on x
TL:DR: * LayerZero says it was Kelp's fault for running 1/1 DVN setup, their docs warn against that (although LZ operated the actual DVN) * Yep, North Korea again * LayerZero had solid opsec but still got pwned (they're not disclosing the original compromise path it seems) *
@0xngmi @0xngmi on x
The attack was 1. North Korea figured out which RPC providers LZ was using 2. They compromised two of the providers to make them return fake data 3. DDoSed other providers to shut them down, forcing LZ to use the bad ones AFAIK I was the only one who actually called it [image]
@chainlinkgod Zach Rynes on x
As expected, LayerZero is deflecting responsibility that their own DVN node infrastructure was compromised and caused a $290M bridge exploit They throw KelpDAO under the bus for the crime of trusting the LayerZero Labs DVN, a 1/1 setup they willingly supported and only blocked
@joelkatz David ‘JoelKatz’ Schwartz on x
The attack was way more sophisticated than I expected and aimed at LayerZero infrastructure taking advantage of KelpDAO laziness.

Chronicles

LayerZero says North Korea's Lazarus is likely behind the $292M Kelp DAO exploit on April 18, which triggered $10B in outflows from Aave over bad debt concerns

Related Coverage

Discussion