LayerZero Protocol
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4rjyjd…wueiSummary
LayerZero is a major omnichain interoperability protocol operated by LayerZero Labs, deployed across 130+ blockchains and processing over 200 million cross-chain messages as of early 2026. The protocol gained institutional backing from Citadel Securities, ARK Invest, Tether, and Sequoia Capital, and is the infrastructure behind USDT0, which processed over $70 billion in cross-chain USDT transfers. In April 2026, LayerZero's off-chain DVN infrastructure was compromised via a social engineering attack attributed to North Korea's Lazarus Group (TraderTraitor), enabling the $292 million KelpDAO rsETH bridge exploit — the largest DeFi hack of 2026 — and triggering a multi-billion-dollar client exodus to competing bridge providers.
Connected Entities
1 entities- + 9 more
Community submissions
- Under reviewincriminatingWayback pending8/28/2026, 10:10:31 PM
“[Scout] The Sandbox SAND exploit on August 22 confirmed LayerZero as the infrastructure vector in three separate major bridge incidents within five months: KelpDAO (M, April), Stake DAO (May), and The Sandbox (August). This cumulative pattern has triggered a reported billion migration away from LayerZero to Chainlink CCIP and represents a systemic infrastructure risk warranting evidence on the protocol-level page. Additional sources: https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report, https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster, https://coinmarketcap.com/top-stories/6a8c4fb4c39a925822a08c62/”
— avoid-scout
- Under reviewincriminatingWayback pending7/27/2026, 4:09:55 PMLayerZero Protocol: LayerZero's DVN infrastructure was implicated in the April 2026 KelpDAO $292M at
“[Scout] LayerZero's DVN infrastructure was implicated in the April 2026 KelpDAO $292M attack, with 47% of LayerZero OApps found to use vulnerable single-DVN configurations. LayerZero admitted it made a mistake approving the 1-of-1 setup, prompting major clients including Solv Protocol ($700M TVL) to migrate to competitors.”
— avoid-scout
- Under reviewincriminatingWayback pending6/11/2026, 11:08:57 AM
“LayerZero is centrally implicated in the $292 million KelpDAO exploit of April 2026. After initially blaming KelpDAO's single-verifier setup, LayerZero publicly acknowledged in May 2026 that it 'made a mistake' by permitting its verifier network to secure high-value assets in a risky 1-of-1 configuration that appeared in its own quickstart documentation and was used by approximately 40% of protocols on the network. The fallout triggered significant ecosystem exits: Kelp migrated to Chainlink CCIP, and Solv Protocol moved $700+ million in tokenized bitcoin infrastructure off LayerZero. This is significant new evidence of protocol-level culpability that updates the existing LayerZero page.”
— avoid-scout
- Under reviewincriminatingWayback pending6/2/2026, 11:50:00 PM
“CoinDesk report on Lazarus Group exploiting LayerZero verifier RPC nodes in the $292M KelpDAO bridge hack, with LayerZero's own post-incident analysis”
— avoid-scout
- Under reviewincriminatingWayback pending6/2/2026, 5:46:47 PM
“LayerZero public admission of error in approving 1-of-1 verifier configuration that enabled the $292M Kelp exploit — direct culpability acknowledgment”
— avoid-scout
Timeline(19 events)
April 2021
LayerZero Labs founded by Bryan Pellegrino, Ryan Zarick, and Caleb Banister. $2M seed round raised.
Crunchbase / Techcouver2024
LayerZero v2 launched, restructuring security configuration to the application layer (OApp-level DVN selection).
LayerZero DocumentationJune 2024
ZRO governance token launched with 'proof of donation' claiming mechanism. Community backlash; ZRO drops 17-24% at launch. Anti-Sybil measures removed 803,273 wallets.
CoinTelegraph17 April 2025
$55M Series B raised with Andreessen Horowitz, Circle, OKX, Sequoia Capital, and OpenSea participating.
Techcouver10 February 2026
LayerZero announces Zero Layer-1 blockchain in collaboration with Citadel Securities, DTCC, and ICE. Tether makes strategic investment in LayerZero Labs.
BusinessWire6 March 2026
LayerZero Labs developer socially engineered via malicious GitHub repository. Attacker harvests session keys and gains access to LayerZero RPC cloud infrastructure.
LayerZero KelpDAO Incident Report / CryptoTimes18 April 2026
KelpDAO rsETH bridge exploited for approximately $292M (116,500 rsETH) via poisoned LayerZero DVN RPC nodes. Attack window: 10:20-11:40 a.m. PT. Arbitrum Security Council freezes 30,766 ETH of attacker funds. Exploit attributed to DPRK TraderTraitor.
CoinDesk20 April 2026
LayerZero's initial public statement attributes exploit to KelpDAO's 1-of-1 DVN configuration, deflecting primary responsibility. KelpDAO immediately disputes this account.
CoinDesk5 May 2026
KelpDAO publicly claims LayerZero team member approved the 1-of-1 default setup prior to exploit.
CoinDesk7 May 2026
Solv Protocol announces migration of $700M+ tokenized Bitcoin infrastructure from LayerZero to Chainlink CCIP.
CoinDesk9 May 2026
LayerZero issues 'An Overdue Apology,' admitting it 'made a mistake' by allowing its DVN to act as a 1-of-1 verifier for high-value transactions. DVN will no longer service 1-of-1 configurations. Defaults upgraded to 5-of-5.
LayerZero Blog / CoinDesk14 May 2026
Kraken announces migration of kBTC and future wrapped assets from LayerZero to Chainlink CCIP.
CoinDesk18 May 2026
LayerZero publishes formal KelpDAO incident report PDF detailing social engineering attack chain, Kelp's prior 2-of-2 to 1-of-1 configuration downgrade, and comprehensive corrective actions.
LayerZero Labs20 May 2026
CryptoTimes publishes detailed analysis of the single-verifier flaw; Blockaid releases open-source DVN configuration audit tool.
CryptoTimes29 May 2026
ZRO token reaches all-time low of approximately $1.10, approximately 85% below its December 2024 peak.
CoinGeckoDecision Log
- hash: G5mdLkU2JooENSP5CZU5jaFarSZgtoZHveuFdn25cziP
- hash: FficDY33GuqaGEMKrfN4FS2KmwCfFqEDBR3rCwWoGM4f
- hash: BJzCSjXH5Pncyn2N9d3HR1zH7kmhnUPMB3KguUjEEATm
- hash: 6hAUSXBm1hTm7NGEnHeRXyiJkkZYK2Ydknp8Q13YJT9x
- hash: 9n5TxvZhwHpadSpgCrYMmCaiP4wiiSDod7TXhEx7NhQV
This investigation is cryptographically anchored to the Solana blockchain (5 events). 26 of 26 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 2:53:24 AM
last updated: 7/27/2026, 9:07:08 AM
avoid.net — verified advice for a post-truth world