LayerZero
Summary
LayerZero is an omnichain messaging protocol developed by LayerZero Labs that enables cross-chain communication across 90+ blockchains. On April 18, 2026, a $292 million exploit of the KelpDAO rsETH bridge — the largest DeFi hack of 2026 — exposed a critical single-point-of-failure in the protocol's Decentralized Verifier Network (DVN) configuration, attributed by LayerZero to North Korea's TraderTraitor (Lazarus Group). LayerZero initially blamed KelpDAO for the configuration before reversing course in May 2026 and admitting fault, triggering a mass client exodus exceeding $1 billion in migrated assets.
Connected Entities
1 entities · 10 linked investigations- + 3 more
Community submissions
- Under reviewincriminatingWayback pending6/4/2026, 3:02:46 AM
“LayerZero own post-mortem confirming developer session key compromise via social engineering and RPC infrastructure memory-patching, directly enabling the $292M KelpDAO exploit”
— avoid-scout
Timeline(13 events)
2022-03-01
LayerZero Labs raises $135 million Series A co-led by a16z Crypto, Sequoia Capital, and FTX Ventures.
The Block2022-03-15
Ackee Blockchain completes first public security audit of LayerZero v1 protocol.
LayerZero-Labs GitHub2023-01-31
Security concerns raised over LayerZero's bridge integration with Uniswap regarding trusted third-party reliance; Pellegrino denies critical vulnerabilities.
The Block2023-03-01
LayerZero's production 2-of-5 multisig keys are observed executing McPepes memecoin trades on Uniswap V3; Pellegrino attributes transactions to former multisig members and OFT testing.
Cryptopolitan2023-04-04
LayerZero Labs closes $120 million Series B at $3 billion valuation with 33 investors including a16z, Sequoia, Samsung Next, Christie's, and Circle Ventures.
CoinDesk2024-06-20
ZRO token distributed to approximately 1.28 million wallets; 'Proof of Donation' claiming mechanism triggers community backlash and 24% price drop in 24 hours.
CoinTelegraph2026-03-06
Alleged start of the KelpDAO attack chain: social engineering used against a LayerZero Labs developer to obtain session keys, per LayerZero's May 2026 incident report.
CryptoTimes2026-04-18
KelpDAO's LayerZero-powered rsETH bridge exploited for 116,500 rsETH (~$292 million) at 17:35 UTC. Attacker forged a cross-chain message authenticated by compromised LayerZero Labs DVN nodes. KelpDAO pauses contracts 46 minutes later, blocking two additional ~$100 million attempted drains.
CoinDesk2026-04-20
LayerZero publicly blames KelpDAO's 1-of-1 DVN configuration for the exploit and attributes the attack with preliminary confidence to North Korea's TraderTraitor (Lazarus Group).
CoinDesk2026-05-05
KelpDAO publicly disputes LayerZero's account, releasing Telegram screenshots showing LayerZero personnel approved the 1-of-1 setup over 2.5 years and eight integration discussions. KelpDAO announces migration to Chainlink CCIP.
CoinDesk2026-05-07
Solv Protocol announces migration of over $700 million in tokenized bitcoin infrastructure (SolvBTC, xSolvBTC) from LayerZero to Chainlink CCIP, deprecating LayerZero bridges on Corn, Berachain, Rootstock, and TAC.
CoinDesk2026-05-09
LayerZero issues public apology, admitting 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions.' Announces new minimum 3-of-3 and default 5-of-5 DVN configurations. Announces development of custom multisig infrastructure 'OneSig.'
CoinDesk2026-05-20
LayerZero releases detailed technical post-mortem of the KelpDAO incident, disclosing the March 6 social engineering attack chain and full infrastructure compromise timeline.
CryptoTimesDecision Log
- hash: 81E5Ui9WzfYZk9nU8x2Tk5Ur4A9J6oRR7P1J6ZFXBqnd
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/3/2026, 5:05:22 PM
last updated: 6/3/2026, 5:05:33 PM
avoid.net — verified advice for a post-truth world