LayerZero, in its statement regarding the Kelp DAO attack worth approximately $290 million, stated that the root cause of the incident was vulnerabilities in Kelp’s security architecture.
The company highlighted that the liquid restaking protocol Kelp DAO uses a single-verifier system instead of a multi-verifier system, despite prior warnings.
According to LayerZero, the attackers used a new method that focused on the infrastructure layer instead of targeting the protocol code. The statement indicated that the attack was most likely carried out by the North Korea-linked Lazarus Group and its subgroup, TraderTraitor. The attackers reportedly compromised two RPC nodes used in the verification process, making fraudulent transactions appear as if they had been verified.
However, the attackers manipulated the system by launching distributed denial-of-service (DDoS) attacks against other intact RPC nodes. This ensured that the validator system only received data from the compromised nodes, and 116,500 rsETH fell under the attackers’ control via the bridge.
LayerZero emphasized that the incident was only possible due to Kelp’s “1-of-1” validator configuration. The company stated that such an attack would not be successful in systems using multiple validators. They also noted that other applications running on the protocol were not affected and that there was no overall system vulnerability.
According to experts, this incident highlights the importance of infrastructure security in the DeFi ecosystem and points to increasingly sophisticated methods being developed by attacker groups.
*This is not investment advice.