LayerZero — DVN Single-Verifier Configuration Risk
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·37BR3y…Lu92Summary
LayerZero is a cross-chain messaging protocol whose permissive Decentralized Verifier Network (DVN) architecture allowed integrating protocols to deploy bridges secured by a single verifier. In April 2026, this design pattern was exploited by the DPRK-affiliated Lazarus Group (TraderTraitor unit), which compromised LayerZero Labs' own DVN infrastructure to forge cross-chain messages and drain approximately $292 million from KelpDAO's rsETH bridge — the largest DeFi exploit of 2026. LayerZero has since publicly admitted a mistake in allowing its DVN to operate as a 1-of-1 verifier for high-value transactions and has announced policy changes, but the incident triggered a $15 billion migration of secured value away from LayerZero to competing infrastructure. A separate August 2026 exploit of The Sandbox's LayerZero-powered bridge deepened concerns about systemic risk across LayerZero integrations.
Connected Entities
1 entities- + 4 more
Timeline(14 events)
6 March 2026
Alleged initial compromise: TraderTraitor reportedly socially engineered a LayerZero Labs developer, harvesting session keys and gaining access to LayerZero's RPC cloud environment.
The Defiant / LayerZero incident reporting18 April 2026
KelpDAO rsETH bridge drained for approximately $292 million (116,500 rsETH) via a forged cross-chain message authenticated by a single compromised DVN. KelpDAO's emergency multisig paused contracts 46 minutes after the initial drain, blocking a second attempted theft.
CoinDesk / Blockaid / Chainalysis20 April 2026
LayerZero publishes initial incident statement attributing the exploit to KelpDAO's choice of a 1/1 DVN configuration and to DPRK threat actor TraderTraitor. KelpDAO disputes this account, claiming LayerZero's default settings caused the disaster.
CoinDesk21 April 2026
CoinDesk analysis published examining why crypto bridges remain one of the industry's weakest links, using the KelpDAO exploit as a case study.
CoinDesk5 May 2026
KelpDAO publicly claims that LayerZero personnel reviewed and approved the 1/1 DVN configuration that LayerZero blamed for the exploit.
CoinDesk6 May 2026
KelpDAO announces migration of rsETH from LayerZero's OFT standard to Chainlink CCIP.
Cryptonomist7 May 2026
Solv Protocol announces $700 million tokenized Bitcoin migration from LayerZero to Chainlink CCIP.
CoinDesk9 May 2026
LayerZero publicly admits it 'made a mistake' in the KelpDAO DVN configuration, reversing weeks of blaming KelpDAO. LayerZero states it 'didn't police what our DVN was securing.'
CoinDesk15 May 2026
Kraken announces migration from LayerZero to Chainlink CCIP for kBTC and future wrapped assets.
Cryptonomist18 May 2026
LayerZero publishes formal incident report (PDF) detailing the attack, attributing it to TraderTraitor, and announcing policy changes including refusing to sign 1/1 DVN configurations and migrating defaults to 5/5 or 3/3 depending on chain.
LayerZero (official)4 August 2026
BitGo moves approximately $7.4 billion in Wrapped Bitcoin (WBTC) from LayerZero to Chainlink CCIP, pushing the total LayerZero-to-Chainlink migration tally near $15 billion.
CoinDesk21 August 2026
The Sandbox (SAND) LayerZero-powered bridge exploited. Attacker hijacks LayerZero delegate permissions via an approveAndCall function vulnerability to mint approximately 329 trillion unbacked SAND tokens on Base and BNB Smart Chain over five hours. Actual losses from backed reserves estimated at approximately $675,000.
Crypto.news / BeInCrypto22 August 2026
The Sandbox halts bridging to and from Base and BNB Smart Chain following discovery of the exploit.
Coinpaprika20 August 2026
Total publicly announced value migrated from LayerZero to Chainlink CCIP reported at approximately $15 billion.
CryptonomistDecision Log
- hash: F5CNXqRe5riKeJ759yyaQxZsuCsZGibXknpYbUYbXyDb
This investigation is cryptographically anchored to the Solana blockchain (1 event). 27 of 31 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/2/2026, 12:28:17 PM
last updated: 9/2/2026, 7:50:30 PM
avoid.net — verified advice for a post-truth world