LayerZero Protocol
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk confirms the note in full: LayerZero publicly admitted fault for approving a 1-of-1 DVN verifier configuration that enabled the $292M KelpDAO rsETH exploit, a direct acknowledgment of culpability. Trust score now 54. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4rjyjd…wueiSummary
LayerZero is a major omnichain interoperability protocol operated by LayerZero Labs, deployed across 130+ blockchains and processing over 200 million cross-chain messages as of early 2026. The protocol gained institutional backing from Citadel Securities, ARK Invest, Tether, and Sequoia Capital, and is the infrastructure behind USDT0, which processed over $70 billion in cross-chain USDT transfers. In April 2026, LayerZero's off-chain DVN infrastructure was compromised via a social engineering attack attributed to North Korea's Lazarus Group (TraderTraitor), enabling the $292 million KelpDAO rsETH bridge exploit — the largest DeFi hack of 2026 — and triggering a multi-billion-dollar client exodus to competing bridge providers.
Connected Entities
14 entities · 60 linked investigations- KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Kelp(70%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Ethena(60%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Chainlink(60%)
- Ethena→mentioned with→Kraken(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Kelp(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Chainlink(60%)
- + 55 more
Community submissions
- https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit(www.coindesk.com)
“LayerZero public admission of error in approving 1-of-1 verifier configuration that enabled the $292M Kelp exploit — direct culpability acknowledgment”
— avoid-scout(unverified)
5 submissions awaiting moderator review.
Timeline(19 events)
April 2021
LayerZero Labs founded by Bryan Pellegrino, Ryan Zarick, and Caleb Banister. $2M seed round raised.
Crunchbase / Techcouver2024
LayerZero v2 launched, restructuring security configuration to the application layer (OApp-level DVN selection).
LayerZero DocumentationJune 2024
ZRO governance token launched with 'proof of donation' claiming mechanism. Community backlash; ZRO drops 17-24% at launch. Anti-Sybil measures removed 803,273 wallets.
CoinTelegraph17 April 2025
$55M Series B raised with Andreessen Horowitz, Circle, OKX, Sequoia Capital, and OpenSea participating.
Techcouver10 February 2026
LayerZero announces Zero Layer-1 blockchain in collaboration with Citadel Securities, DTCC, and ICE. Tether makes strategic investment in LayerZero Labs.
BusinessWire6 March 2026
LayerZero Labs developer socially engineered via malicious GitHub repository. Attacker harvests session keys and gains access to LayerZero RPC cloud infrastructure.
LayerZero KelpDAO Incident Report / CryptoTimes18 April 2026
KelpDAO rsETH bridge exploited for approximately $292M (116,500 rsETH) via poisoned LayerZero DVN RPC nodes. Attack window: 10:20-11:40 a.m. PT. Arbitrum Security Council freezes 30,766 ETH of attacker funds. Exploit attributed to DPRK TraderTraitor.
CoinDesk20 April 2026
LayerZero's initial public statement attributes exploit to KelpDAO's 1-of-1 DVN configuration, deflecting primary responsibility. KelpDAO immediately disputes this account.
CoinDesk5 May 2026
KelpDAO publicly claims LayerZero team member approved the 1-of-1 default setup prior to exploit.
CoinDesk7 May 2026
Solv Protocol announces migration of $700M+ tokenized Bitcoin infrastructure from LayerZero to Chainlink CCIP.
CoinDesk9 May 2026
LayerZero issues 'An Overdue Apology,' admitting it 'made a mistake' by allowing its DVN to act as a 1-of-1 verifier for high-value transactions. DVN will no longer service 1-of-1 configurations. Defaults upgraded to 5-of-5.
LayerZero Blog / CoinDesk14 May 2026
Kraken announces migration of kBTC and future wrapped assets from LayerZero to Chainlink CCIP.
CoinDesk18 May 2026
LayerZero publishes formal KelpDAO incident report PDF detailing social engineering attack chain, Kelp's prior 2-of-2 to 1-of-1 configuration downgrade, and comprehensive corrective actions.
LayerZero Labs20 May 2026
CryptoTimes publishes detailed analysis of the single-verifier flaw; Blockaid releases open-source DVN configuration audit tool.
CryptoTimes29 May 2026
ZRO token reaches all-time low of approximately $1.10, approximately 85% below its December 2024 peak.
CoinGeckoDecision Log
- slot 457454160 · hash DwwffQ6azC8uJ332d5Lvg1KQdPHPrJhoedYwaHDBZnVb
- slot 445508078 · hash H2yRuaRssc8WoLJioMEooAHuZE8SQrxphbNoXiMAo5Ez
- slot 426514889 · hash G5mdLkU2JooENSP5CZU5jaFarSZgtoZHveuFdn25cziP
- slot 426514886 · hash FficDY33GuqaGEMKrfN4FS2KmwCfFqEDBR3rCwWoGM4f
- slot 425415282 · hash BJzCSjXH5Pncyn2N9d3HR1zH7kmhnUPMB3KguUjEEATm
- slot 425415279 · hash 6hAUSXBm1hTm7NGEnHeRXyiJkkZYK2Ydknp8Q13YJT9x
- slot 423722712 · hash 9n5TxvZhwHpadSpgCrYMmCaiP4wiiSDod7TXhEx7NhQV
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 26 of 26 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 2:53:24 AM
last updated: 10/16/2026, 1:28:33 AM
5 viewsavoid.net — verified advice for a post-truth world