{"investigation":{"slug":"layerzero","entity_name":"LayerZero","trust_score":28,"severity_base":null,"score_modifier":14,"confidence":0.87,"status":"draft","content_type":"investigation","summary":"LayerZero is a cross-chain interoperability protocol that underpins dozens of DeFi applications with billions in total value locked. On April 18, 2026, a $292 million exploit drained KelpDAO's rsETH bridge after LayerZero's Decentralized Verifier Network (DVN) infrastructure was compromised via a 1-of-1 single-node configuration, enabling attackers attributed to North Korea's Lazarus Group (TraderTraitor/UNC4899) to forge a cross-chain message without any redundancy check. LayerZero subsequently acknowledged it 'made a mistake' in allowing its DVN to operate in 1/1 mode for high-value assets and announced it would no longer service such configurations, while a dispute with KelpDAO over responsibility for the configuration remains unresolved.","sections":[{"content":"LayerZero is a cross-chain messaging protocol that allows decentralized applications (OApps) to send arbitrary data and tokens across blockchains. Its V2 architecture relies on Decentralized Verifier Networks (DVNs) — off-chain entities that attest to the validity of cross-chain messages before the destination chain releases funds. At the time of the April 2026 incident, LayerZero V2 maintained a total value locked of approximately $7.2 billion across connected protocols, including Ethena's USDe, Wrapped Bitcoin, USDT0, and various restaking derivatives. Protocols using LayerZero include both consumer-facing DeFi products and institutional tokenization infrastructure.","heading":"Background and Protocol Overview","sources":[{"url":"https://defillama.com/protocol/layerzero","name":"LayerZero TVL and Protocol Data — DeFiLlama","type":"research","credibility":2},{"url":"https://ambcrypto.com/?p=597001","name":"LayerZero loses $2B in protocol TVL after exploit fallout — AMBCrypto","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On April 18, 2026, attackers drained 116,500 rsETH (approximately $292 million) from KelpDAO's LayerZero-powered rsETH bridge, making it the largest DeFi exploit of 2026. The attack did not exploit any smart contract vulnerability. OpenZeppelin's post-mortem confirmed zero smart contract bugs; the contracts 'performed exactly as written.' The failure was entirely in off-chain infrastructure and integration configuration. Attackers submitted a fabricated cross-chain message claiming 116,500 rsETH had been locked on the source chain (Unichain) — no corresponding source transaction existed. Because KelpDAO's bridge ran a 1-of-1 DVN configuration, a single compromised verifier was sufficient to attest to the fraudulent message. LayerZero's on-chain contracts accepted the attestation as valid and released the funds. KelpDAO's emergency multisig paused core contracts approximately 46 minutes after the initial drain, blocking a second forged packet targeting an additional 40,000 rsETH (~$100 million). The attacker deposited the stolen rsETH into Aave V3 as collateral to borrow approximately 126,000 WETH, creating an estimated $123–230 million in bad debt across Aave lending pools on five chains. WETH pools across those chains reached 100% utilization. A coordinated recovery effort called 'DeFi United' was subsequently formed by Aave service providers, KelpDAO, Ether.fi, LayerZero, and Mantle to restore rsETH's backing.","heading":"The April 2026 KelpDAO Bridge Exploit","sources":[{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","name":"Aave could face up to $230M in losses after Kelp DAO bridge exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1},{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"How a Single LayerZero DVN Compromise Drained $292M from KelpDAO — Blockaid","type":"research","credibility":2},{"url":"https://www.kucoin.com/blog/kelpdao-rseth-exploit-how-292m-layerzero-bridge-attack-created-177m-bad-debt-in-aave","name":"KelpDAO rsETH Exploit: How the $292M LayerZero Bridge Attack Created $177M Bad Debt on Aave — KuCoin","type":"news_article","credibility":2}],"severity":"critical"},{"content":"According to LayerZero's published incident report, the attack began on March 6, 2026 — over six weeks before the April 18 drain — when an attacker socially engineered a LayerZero Labs developer to harvest session keys and gain access to LayerZero's RPC cloud environment. The attacker deployed malware that patched running RPC memory to return correct responses to LayerZero's monitoring tools while feeding falsified data to the LayerZero Labs DVN signing service. On the day of the exploit, the attacker simultaneously executed a Denial of Service (DoS) attack against an external RPC provider, forcing the DVN signing service to rely exclusively on two compromised internal nodes. Because the KelpDAO bridge used a 1-of-1 DVN configuration, a single attestation from the poisoned signing service was sufficient to authorize the fraudulent packet. The attack has been attributed to the North Korean state-sponsored threat actor TraderTraitor (also known as UNC4899), a subunit of the Lazarus Group. Attribution was made with preliminary confidence by LayerZero and confirmed independently by Mandiant, CrowdStrike, and Chainalysis.","heading":"Attack Vector: Social Engineering and RPC Node Compromise","sources":[{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report — LayerZero","type":"official","credibility":1},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report (PDF) — LayerZero","type":"official","credibility":1},{"url":"https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/","name":"LayerZero Links $292 Million Kelp DAO Bridge Exploit to North Korea's Lazarus Group — Unchained","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/kelpdao-exploit-layers-of-compromise/","name":"LayerZero says North Korean Lazarus Group behind $292M Kelp DAO attack — CryptoBriefing","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The 1-of-1 DVN configuration at the center of the exploit concentrates all trust in a single verifier. If that verifier is compromised, there is no redundancy check — any message it attests to is accepted as valid. A Dune Analytics post-incident analysis found that 47% of active LayerZero OApp contracts (approximately 1,250 applications) were using the same 1-of-1 configuration, with combined exposure exceeding $4.5 billion. A contested dispute emerged over responsibility for KelpDAO's configuration. LayerZero's April 19, 2026 incident statement asserted that the 1-of-1 setup 'directly contradicts' its recommended multi-DVN model and represents application-level misconfiguration outside protocol scope. CEO Bryan Pellegrino published on-chain evidence purporting to show KelpDAO had originally deployed with a multi-DVN setup (LayerZero Labs plus Google) before allegedly manually downgrading to 1-of-1 on April 1, 2024. KelpDAO disputed this account, asserting the setup reflected LayerZero's documented default configuration and that LayerZero personnel explicitly confirmed via Telegram communications in January 2024 and through subsequent integration discussions that the default was appropriate — without providing any specific recommendation to change it. KelpDAO cited Telegram screenshots showing a LayerZero team member stating 'No problem on using defaults either' regarding the DVN setup. An independent data point: security researcher Sujith Somraaj, a prior LayerZero auditor, submitted a bug bounty report describing the identical attack pattern before the exploit. LayerZero rejected it, stating 1-of-1 configurations were out of scope because they represented application-level choices rather than protocol vulnerabilities. Somraaj later wrote: 'My bug bounty: not a vuln, requires all DVNs. Their deployment: removes the all part. Hackers: collects $295M bounty instead.'","heading":"DVN Configuration Policy: Systemic Risk and Dispute","sources":[{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO hits back at LayerZero for trying to shift blame — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://blockchain.news/news/layerzero-oapps-risk-kelp-dao-hack","name":"47% of LayerZero OApps at Risk After $292M Kelp DAO Hack — Blockchain.news","type":"research","credibility":2},{"url":"https://thedefiant.io/news/security/dune-layerzero-oapp-dvn-security-analysis-1bklaq","name":"Dune Analytics Reveals 47% of LayerZero OApps Use Minimal DVN Security — The Defiant","type":"research","credibility":2},{"url":"https://www.cryptopolitan.com/layerzero-founder-fires-at-kelpdao-hack/","name":"LayerZero founder fires back at 'completely untrue' KelpDAO hack claims — Cryptopolitan","type":"news_article","credibility":2},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"KelpDAO Incident Statement — LayerZero","type":"official","credibility":1}],"severity":"critical"},{"content":"Despite initial pushback by CEO Bryan Pellegrino, LayerZero subsequently issued a public apology and admitted fault in allowing its DVN to operate in 1/1 mode for high-value transactions. LayerZero stated: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions.' The company acknowledged it had failed to monitor what its DVN was securing, creating an undetected systemic vulnerability. A separate internal security lapse was also disclosed: a multisig signer had improperly used company hardware for personal trading activity approximately three and a half years prior. The signer was removed, wallets were rotated, and security practices were updated. Policy changes announced by LayerZero include: (1) the LayerZero DVN will no longer service any 1/1 configuration; (2) all default pathways are migrating to 5/5 verification where feasible, or minimum 3/3 where only three DVNs operate; (3) the company built custom multisig technology called 'OneSig' and added localized anomaly detection software to signing devices. The announcement of these changes represents an implicit acknowledgment that the prior policy created systemic risk across all protocols using the LayerZero DVN in single-verifier mode.","heading":"LayerZero's Admissions and Policy Changes","sources":[{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup","name":"LayerZero issues public apology for Kelp DAO exploit response, admits fault in single-verifier setup — The Block","type":"news_article","credibility":1},{"url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","name":"LayerZero details $292M KelpDAO exploit and tightens bridge security — Crypto.news","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following the exploit and the ensuing public dispute, LayerZero experienced significant client departures and TVL contraction. KelpDAO publicly shifted its rsETH bridge infrastructure to Chainlink CCIP. Solv Protocol, which managed over $700 million in tokenized Bitcoin (SolvBTC and xSolvBTC), announced a full migration to Chainlink CCIP, discontinuing LayerZero support across Corn, Berachain, Rootstock, and TAC networks. Additional protocols including Re and Kraken Bitcoin also joined the migration. Chainlink CCIP reportedly gained over $2.5 billion in TVL from protocols departing LayerZero. LayerZero's total protocol TVL contracted by approximately $2 billion as a result of these migrations. The ZRO token fell approximately 28% over the 30-day period following the exploit, compounded by a concurrent $40.4 million token unlock. The Arbitrum Security Council, coordinating with law enforcement, froze over 30,000 ETH of the attacker's downstream funds.","heading":"Market and Ecosystem Impact","sources":[{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"KelpDAO Slams LayerZero After $300M Exploit, Shifts rsETH to Chainlink CCIP — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration","name":"The $700 million migration: Why Solv Protocol is ditching LayerZero for Chainlink — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/401368/chainlink-ccip-gains-over-2-5-billion-tvl-from-protocols-migrating-layerzero-kraken-bitcoin-latest","name":"Chainlink CCIP gains over $2.5 billion in TVL from protocols migrating from LayerZero — The Block","type":"news_article","credibility":1},{"url":"https://ambcrypto.com/?p=597001","name":"LayerZero loses $2B in protocol TVL after exploit fallout — AMBCrypto","type":"news_article","credibility":2},{"url":"https://www.banklesstimes.com/articles/2026/05/06/layerzero-zro-crashes-as-kelpdao-moves-to-chainlink-ccip/","name":"LayerZero (ZRO) Crashes as KelpDAO Moves to Chainlink CCIP — BanklessTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"OpenZeppelin's post-mortem identified a systemic gap in the DeFi security model: traditional smart contract audits do not assess third-party integration configurations, infrastructure dependencies, or off-chain component reliability. The KelpDAO exploit demonstrated that a protocol can pass all code-level audits with zero vulnerabilities and still suffer a complete bridge failure due to off-chain configuration policy. LayerZero's own best-practice documentation recommended multi-DVN setups for redundancy, but single-DVN configurations remained common across integrations, including in default reference materials. The incident has accelerated industry discussion about whether bridge security reviews should mandate off-chain infrastructure assessments, DVN configuration standards, and operator key management protocols as conditions of audit certification. The DeFi United recovery coalition — formed in the exploit's aftermath — represents an emerging model for coordinated cross-protocol response to infrastructure failures that create systemic bad debt across lending markets.","heading":"Broader Audit and Industry Implications","sources":[{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","credibility":1},{"url":"https://www.odaily.news/en/post/5210357","name":"$293 Million Evaporated, Zero Code Vulnerabilities: The 2026 Largest Hack Case Reveals DVN Configuration Security Blind Spots — Odaily","type":"news_article","credibility":2},{"url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report","name":"KelpDAO & LayerZero: Incident Report — Nexus Mutual","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2024","event":"KelpDAO and LayerZero enter partnership. KelpDAO alleges LayerZero personnel explicitly confirmed the 1-of-1 DVN default configuration was appropriate during initial L2 expansion discussions.","source":"CoinDesk — Kelp says LayerZero approved setup it blamed for $292 million bridge hack","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","date_original":"2024-01-01"},{"date":"2024-04","event":"LayerZero CEO Bryan Pellegrino alleges KelpDAO manually downgraded its DVN configuration from a multi-DVN setup (LayerZero Labs + Google) to a 1-of-1 configuration, citing on-chain evidence. KelpDAO disputes this account.","source":"Cryptopolitan — LayerZero founder fires back at 'completely untrue' KelpDAO hack claims","source_url":"https://www.cryptopolitan.com/layerzero-founder-fires-at-kelpdao-hack/","date_original":"2024-04-01"},{"date":"2026-03-06","event":"Attack initiation: an attacker socially engineers a LayerZero Labs developer to harvest session keys and gain access to LayerZero's internal RPC cloud environment. Malware is deployed to poison internal RPC nodes while maintaining normal responses to monitoring systems.","source":"LayerZero Labs KelpDAO Incident Report","source_url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"},{"date":"2026-04-18","event":"Exploit executed at approximately 17:35 UTC. Attacker submits a forged LayerZero packet claiming to originate from KelpDAO's Unichain deployment. The compromised 1-of-1 DVN attests to the fraudulent message. 116,500 rsETH (~$292 million) is released to the attacker. Attacker deposits stolen rsETH into Aave V3, borrows approximately $236 million in WETH, creating $123–230 million in bad debt.","source":"Blockaid — How a Single LayerZero DVN Compromise Drained $292M from KelpDAO","source_url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao"},{"date":"2026-04-18","event":"KelpDAO's emergency multisig pauses core contracts approximately 46 minutes after the initial drain, blocking a second forged packet targeting an additional 40,000 rsETH (~$100 million). Arbitrum Security Council coordinates with law enforcement to freeze over 30,000 ETH of attacker downstream funds.","source":"CoinDesk — Kelp DAO exploited for $292 million","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-19","event":"LayerZero publishes an incident statement attributing the exploit to KelpDAO's 1-of-1 DVN configuration, asserting it 'directly contradicts' recommended multi-DVN best practices. LayerZero attributes the attack with preliminary confidence to North Korea's Lazarus Group (TraderTraitor/UNC4899).","source":"CoinDesk — LayerZero blames Kelp's setup for $290 million exploit","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04-20","event":"KelpDAO publicly disputes LayerZero's framing. KelpDAO asserts the 1-of-1 DVN setup reflected LayerZero's documented default and that LayerZero personnel explicitly approved the configuration. KelpDAO announces it will shift rsETH bridge infrastructure to Chainlink CCIP.","source":"CoinDesk — Kelp DAO hits back at LayerZero","source_url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster"},{"date":"2026-04-23","event":"Chainalysis publishes detailed on-chain analysis of the KelpDAO bridge exploit. OpenZeppelin publishes post-mortem confirming zero smart contract vulnerabilities; failure attributed entirely to off-chain infrastructure and configuration policy.","source":"OpenZeppelin — $292 Million Lost, Zero Bugs Found","source_url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack"},{"date":"2026-05-05","event":"KelpDAO provides additional documentation of its allegations, including Telegram screenshots showing a LayerZero team member stating 'No problem on using defaults either' regarding the DVN setup. KelpDAO also surfaces the rejected bug bounty report by security researcher Sujith Somraaj, a prior LayerZero auditor, who had described the identical attack vector.","source":"CoinDesk — Kelp says LayerZero approved setup it blamed for $292 million bridge hack","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-07","event":"Solv Protocol announces migration of over $700 million in SolvBTC and xSolvBTC tokenized Bitcoin infrastructure from LayerZero to Chainlink CCIP, discontinuing LayerZero support across Corn, Berachain, Rootstock, and TAC networks.","source":"CoinDesk — The $700 million migration: Why Solv Protocol is ditching LayerZero for Chainlink","source_url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration"},{"date":"2026-05-09","event":"LayerZero publicly admits fault, stating 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions.' LayerZero announces it will no longer service 1/1 DVN configurations, will migrate default pathways to 5/5 or minimum 3/3 verification, and has built custom multisig technology called OneSig. A separate disclosure reveals a prior internal security lapse involving a multisig holder using company hardware for personal trades.","source":"CoinDesk — LayerZero says it 'made a mistake' in $292 Million Kelp exploit","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-05-18","event":"LayerZero publishes full incident report. Mandiant, CrowdStrike, and independent researchers are cited confirming attribution to TraderTraitor (UNC4899). Chainalysis updates its analysis with additional findings.","source":"LayerZero Labs KelpDAO Incident Report (PDF)","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"}],"sources_used":[{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260609083433/https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","credibility":1,"archive_timestamp":"2026-06-09T08:34:33+00:00"},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report (PDF) — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260727103730/https://layerzero.network/publications/kelpdao-incident-report.pdf","credibility":1,"archive_timestamp":"2026-07-27T10:37:30+00:00"},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"KelpDAO Incident Statement — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260806181836/https://layerzero.network/blog/kelpdao-incident-statement","credibility":1,"archive_timestamp":"2026-08-06T18:18:36+00:00"},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","archive_url":"http://web.archive.org/web/20260724211804/https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","credibility":1,"archive_timestamp":"2026-07-24T21:18:04+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260804014915/https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","credibility":1,"archive_timestamp":"2026-08-04T01:49:15+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO hits back at LayerZero for trying to shift blame — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260619205713/https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","credibility":1,"archive_timestamp":"2026-06-19T20:57:13+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero blames Kelp's setup for $290 million exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526220018/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-05-26T22:00:18+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260801083712/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-08-01T08:37:12+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260724213636/https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","credibility":1,"archive_timestamp":"2026-07-24T21:36:36+00:00"},{"url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration","name":"The $700 million migration: Why Solv Protocol is ditching LayerZero for Chainlink — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260509150421/https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration","credibility":1,"archive_timestamp":"2026-05-09T15:04:21+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","name":"Aave could face up to $230M in losses after Kelp DAO bridge exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260608172650/https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","credibility":1,"archive_timestamp":"2026-06-08T17:26:50+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup","name":"LayerZero issues public apology for Kelp DAO exploit response — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260510093647/https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup","credibility":1,"archive_timestamp":"2026-05-10T09:36:47+00:00"},{"url":"https://www.theblock.co/post/401368/chainlink-ccip-gains-over-2-5-billion-tvl-from-protocols-migrating-layerzero-kraken-bitcoin-latest","name":"Chainlink CCIP gains over $2.5 billion in TVL from protocols migrating from LayerZero — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260516080535/https://www.theblock.co/post/401368/chainlink-ccip-gains-over-2-5-billion-tvl-from-protocols-migrating-layerzero-kraken-bitcoin-latest","credibility":1,"archive_timestamp":"2026-05-16T08:05:35+00:00"},{"url":"https://blockchain.news/news/layerzero-oapps-risk-kelp-dao-hack","name":"47% of LayerZero OApps at Risk After $292M Kelp DAO Hack — Blockchain.news","type":"research","archive_url":"https://web.archive.org/web/20260806195157/https://blockchain.news/news/layerzero-oapps-risk-kelp-dao-hack","credibility":2,"archive_timestamp":"2026-08-06T19:51:57+00:00"},{"url":"https://thedefiant.io/news/security/dune-layerzero-oapp-dvn-security-analysis-1bklaq","name":"Dune Analytics Reveals 47% of LayerZero OApps Use Minimal DVN Security — The Defiant","type":"research","archive_url":"http://web.archive.org/web/20260731130817/https://thedefiant.io/news/security/dune-layerzero-oapp-dvn-security-analysis-1bklaq","credibility":2,"archive_timestamp":"2026-07-31T13:08:17+00:00"},{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"How a Single LayerZero DVN Compromise Drained $292M from KelpDAO — Blockaid","type":"research","archive_url":"http://web.archive.org/web/20260515225319/https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","credibility":2,"archive_timestamp":"2026-05-15T22:53:19+00:00"},{"url":"https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/","name":"LayerZero Links $292 Million Kelp DAO Bridge Exploit to North Korea's Lazarus Group — Unchained","type":"news_article","archive_url":"https://web.archive.org/web/20260806195139/https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/","credibility":2,"archive_timestamp":"2026-08-06T19:51:39+00:00"},{"url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report","name":"KelpDAO & LayerZero: Incident Report — Nexus Mutual","type":"research","archive_url":"http://web.archive.org/web/20260519012535/https://nexusmutual.io/blog/kelpdao-layerzero-incident-report","credibility":2,"archive_timestamp":"2026-05-19T01:25:35+00:00"},{"url":"https://www.cryptopolitan.com/layerzero-founder-fires-at-kelpdao-hack/","name":"LayerZero founder fires back at 'completely untrue' KelpDAO hack claims — Cryptopolitan","type":"news_article","archive_url":"https://web.archive.org/web/20260806195211/https://www.cryptopolitan.com/layerzero-founder-fires-at-kelpdao-hack/","credibility":2,"archive_timestamp":"2026-08-06T19:52:11+00:00"},{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"KelpDAO Slams LayerZero After $300M Exploit, Shifts rsETH to Chainlink CCIP — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260507042312/https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","credibility":2,"archive_timestamp":"2026-05-07T04:23:12+00:00"},{"url":"https://ambcrypto.com/?p=597001","name":"LayerZero loses $2B in protocol TVL after exploit fallout — AMBCrypto","type":"news_article","archive_url":"https://web.archive.org/web/20260807040321/https://ambcrypto.com/layerzero-loses-2b-in-protocol-tvl-after-exploit-fallout-what-next/","credibility":2,"archive_timestamp":"2026-08-07T04:03:21+00:00"},{"url":"https://www.odaily.news/en/post/5210357","name":"$293 Million Evaporated, Zero Code Vulnerabilities: DVN Configuration Security Blind Spots — Odaily","type":"news_article","archive_url":"https://web.archive.org/web/20260807001050/https://www.odaily.news/en/post/5210357","credibility":2,"archive_timestamp":"2026-08-07T00:10:50+00:00"},{"url":"https://www.kucoin.com/blog/kelpdao-rseth-exploit-how-292m-layerzero-bridge-attack-created-177m-bad-debt-in-aave","name":"KelpDAO rsETH Exploit: How the $292M LayerZero Bridge Attack Created $177M Bad Debt on Aave — KuCoin","type":"news_article","archive_url":"http://web.archive.org/web/20260805014227/https://www.kucoin.com/blog/kelpdao-rseth-exploit-how-292m-layerzero-bridge-attack-created-177m-bad-debt-in-aave","credibility":2,"archive_timestamp":"2026-08-05T01:42:27+00:00"},{"url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","name":"LayerZero details $292M KelpDAO exploit and tightens bridge security — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260724175454/https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","credibility":2,"archive_timestamp":"2026-07-24T17:54:54+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-06-03T17:05:22.84936+00:00","updated_at":"2026-08-07T04:06:27.478064+00:00"}}