LayerZero Executor Wallet Incident (July 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4PX4Rh…NegrSummary
On July 15, 2026, security firm PeckShield and on-chain analyst Specter reported that LayerZero executor wallets appeared to have been drained of approximately $2.4 million across eight blockchain networks. LayerZero Core responded the same day, stating the transfers were routine internal inventory rebalancing and that no exploit had occurred and no user funds were at risk. The incident was not independently confirmed as a security breach, and as of the date of this investigation LayerZero's denial has not been publicly contradicted by on-chain forensic analysis or a third-party post-mortem.
Connected Entities
12 entities · 59 linked investigations- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Base(60%)
- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Kelp(70%)
- Mantle→mentioned with→Ethereum(80%)
- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Mantle(60%)
- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Ethereum(70%)
- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Optimism(60%)
- LayerZero Executor Wallet Incident (July 2026)→mentioned with→Arbitrum(60%)
- Optimism→mentioned with→Arbitrum(65%)
- Optimism→mentioned with→Ethereum(80%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- + 31 more
Connected Through
11 shared actors · 593 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □Binanceorganization
- □Arbitrumorganization
- ⌂LayerZero — DVN Single-Verifier Configuration Riskprotocol
Timeline(7 events)
18 April 2026
Kelp DAO bridge exploit drains approximately $292 million from a LayerZero-connected bridge. LayerZero later attributes the attack to North Korea's Lazarus Group (TraderTraitor cluster) and a single-DVN configuration failure in Kelp DAO's setup.
CoinDesk / Chainalysis5 May 2026
Kelp DAO publicly disputes LayerZero's post-mortem, claiming LayerZero had approved the single-DVN configuration it later criticized.
CoinDesk9 May 2026
LayerZero acknowledges it 'made a mistake' in connection with the Kelp DAO exploit.
CoinDesk15 July 2026
PeckShield and on-chain analyst Specter post alerts on X flagging anomalous outflows from LayerZero executor wallets across eight blockchain networks, reporting approximately $2.1–2.4 million in assets moved and bridged to Ethereum.
Bloomingbit / Blockchain Reporter15 July 2026
LayerZero Core issues a same-day denial, stating the transfers were routine internal inventory rebalancing and that no hack occurred and no user funds were at risk.
Bloomingbit15 July 2026
Multiple crypto media outlets including Cryptonomist, Blockchain Reporter, and Coinpedia publish articles characterizing the incident as a confirmed or suspected hack; Live Bitcoin News subsequently publishes the LayerZero denial and characterizes the alarm as a false alarm.
Live Bitcoin News24 July 2026
LayerZero publishes a support update blog post following the incident.
LayerZero official blogDecision Log
- slot 447246011 · hash 8bWetzLekgFEbxURpjcn3vp4XQvkeNbTBy3KRdUBRrqq
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 13 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/15/2026, 12:07:04 PM
last updated: 9/15/2026, 12:07:04 PM
8 viewsavoid.net — verified advice for a post-truth world