Verify a decision

{"actor":"system:backfill","investigation_id":"52cfb889-0676-4834-abff-8a138199d778","kind":"publish","page_slug":"layerzero-labs","published_at":"2026-09-17T23:04:32.978Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LayerZero Labs","sections":[{"content":"LayerZero Labs was co-founded in February 2021 by Bryan Pellegrino (CEO), Caleb Banister, and Ryan Zarick, who met while working together at computer network research labs at the University of New Hampshire. The company is headquartered in Vancouver, Canada, and has raised over $173 million from investors including Sequoia Capital and Andreessen Horowitz. LayerZero Labs develops the LayerZero cross-chain messaging protocol, which had grown to support over 70 blockchains and, entering 2026, handled an estimated 57% of all cross-chain bridge volume. On February 10, 2026, LayerZero Labs announced 'Zero,' a new Layer 1 blockchain targeting institutional use cases with backing from Citadel Securities, the Depository Trust and Clearing Corporation (DTCC), Intercontinental Exchange (ICE), ARK Invest, and Google Cloud.","heading":"Company Overview","severity":"low","sources":[{"credibility":1,"name":"LayerZero Announces Zero Blockchain — BusinessWire","type":"news_article","url":"https://www.businesswire.com/news/home/20260210491975/en/LayerZero-Announces-Zero-Blockchain-to-Build-Global-Market-Infrastructure-In-Collaboration-with-Citadel-Securities-The-Depository-Trust-Clearing-Corporation-Intercontinental-Exchange-With-Strategic-Investment-in-ZRO-from-Citadel-Securities"},{"credibility":2,"name":"Bryan Pellegrino: From Poker to Protocols — Sequoia Capital","type":"other","url":"https://sequoiacap.com/article/bryan-pellegrino-spotlight-layerzero"}]},{"content":"On April 18, 2026, the KelpDAO rsETH bridge — built on LayerZero — was exploited for approximately $292 million in rsETH, representing the largest DeFi hack of 2026. The breach traced back to March 6, 2026, when an attacker socially engineered a LayerZero Labs developer, harvesting session keys that granted access to LayerZero's internal RPC cloud environment. The attacker then patched running RPC memory to return correct responses to LayerZero's monitoring systems while feeding tampered data to LayerZero's own DVN (Decentralized Verifier Network) signing service. The attacker additionally executed a denial-of-service attack against an external RPC provider, forcing the LayerZero Labs DVN to rely exclusively on two compromised internal nodes. With no redundant verifier to cross-check, the attacker crafted a forged LayerZero packet falsely claiming to originate from KelpDAO's Unichain deployment. The single compromised DVN attested to the fabricated message, and LayerZero's on-chain contracts released 116,500 rsETH from escrow to the attacker. Mandiant, CrowdStrike, and independent security researchers attributed the attack to DPRK threat actor TraderTraitor (also known as UNC4899), a state-sponsored group also linked to the Lazarus Group.","heading":"The April 2026 KelpDAO Exploit: Infrastructure Compromise","severity":"critical","sources":[{"credibility":1,"name":"Kelp DAO exploited for $292 million — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":2,"name":"How a Single LayerZero DVN Compromise Drained $292M from KelpDAO — Blockaid","type":"research","url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":2,"name":"LayerZero Discloses RPC Poisoning Incident — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/layerzero-discloses-rpc-poisoning-incident-linked-to-292m-kelpdao-hack/"}]},{"content":"In the days following the April 18 exploit, LayerZero Labs issued a public statement attributing the incident to KelpDAO's application-level configuration choices, framing it as a developer error rather than a protocol or infrastructure failure. On May 5, 2026, CoinDesk reported that KelpDAO publicly countered this framing, asserting that LayerZero personnel had reviewed and explicitly approved KelpDAO's single-verifier configuration before the exploit occurred. On May 9, 2026, LayerZero Labs formally reversed its position. In a public statement, the company said: 'We believe developers should choose their own security configurations, but we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions. We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that.' The company also acknowledged: 'We've done a terrible job on comms over the past three weeks.' This constitutes a published, attributed corporate admission of operational failure by LayerZero Labs.","heading":"Corporate Admission of Fault and Prior Approval of Vulnerable Configuration","severity":"high","sources":[{"credibility":1,"name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"credibility":1,"name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":2,"name":"LayerZero Says 'We Own That' After $292M Kelp DAO Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"},{"credibility":1,"name":"LayerZero issues public apology for Kelp DAO exploit response — The Block","type":"news_article","url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup"}]},{"content":"Post-incident analysis based on Dune Analytics data found that 47% of active LayerZero omnichain application (OApp) contracts were operating under a 1-of-1 DVN configuration at the time of the attack — the exact setup that enabled the KelpDAO exploit. The combined asset exposure across these contracts was estimated to exceed $4.5 billion, with Tether's USDT0 stablecoin representing approximately 87% of the identified concentration risk across Ethereum, Optimism, and Base deployments. LayerZero's own documentation warned against single-verifier configurations for high-value transactions, yet the company had not enforced this guidance. This finding materially broadens the scope of the incident beyond KelpDAO, indicating that the vulnerability was structural and widespread across the LayerZero ecosystem, not isolated to a single application.","heading":"Systemic Risk: 47% of OApp Contracts Used Vulnerable Configuration","severity":"critical","sources":[{"credibility":2,"name":"47% of LayerZero OApps at Risk After $292M Kelp DAO Hack — Blockchain.news","type":"research","url":"https://blockchain.news/news/layerzero-oapps-risk-kelp-dao-hack"},{"credibility":2,"name":"LayerZero Details Single-Verifier Flaw Behind $292M KelpDAO Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/20/layerzero-details-single-verifier-flaw-behind-292m-kelpdao-exploit/"},{"credibility":2,"name":"DVN Configuration Security Blind Spots — Odaily","type":"news_article","url":"https://www.odaily.news/en/post/5210357"}]},{"content":"Following the exploit and the company's public admission, a sustained migration away from LayerZero bridge infrastructure began. KelpDAO announced it was migrating its rsETH bridge to Chainlink CCIP. Solv Protocol announced on May 7, 2026, that it was moving approximately $700 million in tokenized bitcoin (SolvBTC and xSolvBTC) to Chainlink CCIP. By mid-May 2026, approximately $4 billion in assets had switched to Chainlink. Subsequent migrations included Lombard (over $1 billion), BitGo's WBTC ($7.4 billion), Mantle's Super Portal ($2.5 billion), Kraken, Virtuals, Re, and the state of Wyoming's stablecoin infrastructure. By mid-August 2026, the total value covered by publicly announced LayerZero-to-Chainlink migrations had reached approximately $15 billion, according to CoinDesk reporting. Nethermind, one of LayerZero's own DVN operators, ended its role and joined Chainlink as a node operator. LayerZero had entered 2026 handling an estimated 57% of all cross-chain bridge volume.","heading":"Ecosystem Migration: Approximately $15 Billion in Assets Exited LayerZero","severity":"high","sources":[{"credibility":1,"name":"Solv drops LayerZero for Chainlink CCIP in $700 million tokenized bitcoin migration — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration"},{"credibility":1,"name":"Crypto firms move $4 billion to Chainlink as bridge security comes under scrutiny — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/05/15/lombard-joins-layerzero-exodus-as-usd4-billion-in-assets-switch-to-chainlink-s-bridge"},{"credibility":1,"name":"BitGo's WBTC move pushes LayerZero-to-Chainlink tally near $15 billion — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/04/bitgo-s-wbtc-move-pushes-layerzero-to-chainlink-tally-near-usd15-billion"},{"credibility":1,"name":"Wyoming joins near-$15 billion LayerZero exodus with state stablecoin move — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/18/wyoming-joins-usd15-billion-layerzero-exodus-with-state-stablecoin-move"},{"credibility":2,"name":"Kelp Blames LayerZero for $292 Million Hack, Plans Switch to Chainlink — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/kelp-blames-layerzero-292-million-223156936.html"}]},{"content":"Following its public admission, LayerZero Labs announced that its DVN will no longer service any applications operating in a 1-of-1 configuration. The company stated it is migrating all defaults on all pathways to a 5-of-5 DVN configuration where possible, and no less than 3-of-3 on any chain where fewer DVNs are available. LayerZero Labs published a formal incident report (dated May 18, 2026) at layerzero.network/publications/kelpdao-incident-report.pdf, detailing the technical timeline of the breach. The company also deprecated the two compromised internal RPC nodes. Whether these remediation steps are sufficient to address the broader ecosystem confidence loss and the systemic 47% OApp exposure identified post-incident is a matter of ongoing market assessment.","heading":"Remediation and Policy Changes","severity":"medium","sources":[{"credibility":2,"name":"LayerZero details $292M KelpDAO exploit and tightens bridge security — Crypto.news","type":"news_article","url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/"},{"credibility":1,"name":"LayerZero Labs KelpDAO Incident Report PDF — LayerZero (official)","type":"official","url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"}]},{"content":"In June 2024, LayerZero Labs launched its ZRO governance token with a claiming mechanism that required users to donate $0.10 per token in USDC, USDT, or ETH — a mechanism the company called 'Proof of Donation.' The requirement received significant community backlash, and ZRO lost approximately 24% of its value in the 24 hours following launch. LayerZero Labs had also conducted an aggressive anti-Sybil campaign prior to the distribution, identifying and removing approximately 803,273 addresses (about 59% of eligible wallets) from eligibility. The Sybil campaign itself drew criticism for its scope and methodology. These events predate the 2026 KelpDAO incident but contributed to a pattern of community friction around the company's decision-making processes.","heading":"ZRO Token Airdrop Controversy (2024)","severity":"low","sources":[{"credibility":2,"name":"LayerZero ZRO token airdrop goes live with controversial claiming mechanism — FXStreet","type":"news_article","url":"https://www.fxstreet.com/cryptocurrencies/news/layerzero-zro-token-tumbles-24-in-24-hours-hit-by-airdrop-related-controversy-202406210930"},{"credibility":2,"name":"LayerZero spots 800k sybil addresses in airdrop scheme — Crypto.news","type":"news_article","url":"https://crypto.news/layerzero-spots-800k-sybil-addresses-airdrop-scheme/"},{"credibility":2,"name":"LayerZero's ZRO Token Airdrop Receives Backlash For 'Proof-Of-Donation' Mechanism — NewsBTC","type":"news_article","url":"https://www.newsbtc.com/news/layerzeros-zro-token-airdrop-receives-backlash-for-proof-of-donation-mechanism/"}]},{"content":"As of September 2026, no regulatory actions by the SEC, CFTC, or other government bodies specifically against LayerZero Labs have been identified in publicly available records. No class-action lawsuits or court filings related to the KelpDAO exploit or ZRO token controversy were found in available sources. The absence of identified regulatory action should not be interpreted as a clean regulatory record; investigative gaps may exist. This section will be updated if regulatory proceedings are publicly disclosed.","heading":"Regulatory and Legal Status","severity":"low","sources":[]}],"sources_used":[{"credibility":1,"name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"credibility":1,"name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":1,"name":"Kelp DAO exploited for $292 million — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":1,"name":"LayerZero blames Kelp's setup, attributes to Lazarus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"credibility":1,"name":"Solv drops LayerZero for Chainlink CCIP — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration"},{"credibility":1,"name":"Crypto firms move $4 billion to Chainlink — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/05/15/lombard-joins-layerzero-exodus-as-usd4-billion-in-assets-switch-to-chainlink-s-bridge"},{"credibility":1,"name":"BitGo's WBTC move pushes LayerZero-to-Chainlink tally near $15 billion — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/04/bitgo-s-wbtc-move-pushes-layerzero-to-chainlink-tally-near-usd15-billion"},{"credibility":1,"name":"Wyoming joins near-$15 billion LayerZero exodus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/18/wyoming-joins-usd15-billion-layerzero-exodus-with-state-stablecoin-move"},{"credibility":1,"name":"LayerZero issues public apology — The Block","type":"news_article","url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":2,"name":"47% of LayerZero OApps at Risk — Blockchain.news","type":"research","url":"https://blockchain.news/news/layerzero-oapps-risk-kelp-dao-hack"},{"credibility":2,"name":"How a Single LayerZero DVN Compromise Drained $292M — Blockaid","type":"research","url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao"},{"credibility":2,"name":"LayerZero Says 'We Own That' — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"},{"credibility":2,"name":"LayerZero Details Single-Verifier Flaw — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/20/layerzero-details-single-verifier-flaw-behind-292m-kelpdao-exploit/"},{"credibility":2,"name":"LayerZero details $292M exploit and tightens security — Crypto.news","type":"news_article","url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/"},{"credibility":1,"name":"LayerZero Labs KelpDAO Incident Report PDF — LayerZero (official)","type":"official","url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"credibility":1,"name":"LayerZero KelpDAO Incident Report blog post — LayerZero (official)","type":"official","url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"},{"credibility":1,"name":"LayerZero Announces Zero Blockchain — BusinessWire","type":"news_article","url":"https://www.businesswire.com/news/home/20260210491975/en/LayerZero-Announces-Zero-Blockchain-to-Build-Global-Market-Infrastructure-In-Collaboration-with-Citadel-Securities-The-Depository-Trust-Clearing-Corporation-Intercontinental-Exchange-With-Strategic-Investment-in-ZRO-from-Citadel-Securities"},{"credibility":2,"name":"Kelp Blames LayerZero for $292 Million Hack, Plans Switch to Chainlink — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/kelp-blames-layerzero-292-million-223156936.html"},{"credibility":2,"name":"ZRO token airdrop controversy — FXStreet","type":"news_article","url":"https://www.fxstreet.com/cryptocurrencies/news/layerzero-zro-token-tumbles-24-in-24-hours-hit-by-airdrop-related-controversy-202406210930"},{"credibility":2,"name":"LayerZero $15B Chainlink migration — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/08/20/layerzero-crypto-migration-shift/"}],"summary":"LayerZero Labs is the Vancouver-based company that develops and maintains the LayerZero cross-chain messaging protocol and the ZRO governance token. The company became the subject of significant controversy following the April 2026 $292 million KelpDAO bridge exploit, in which LayerZero's own infrastructure was compromised and its personnel had previously approved the single-verifier configuration that enabled the attack. LayerZero Labs formally admitted in May 2026 that it 'made a mistake,' after weeks of publicly attributing blame to KelpDAO — a reversal that triggered a broader ecosystem migration estimated at approximately $15 billion in assets moving to competing bridge infrastructure.","timeline":[{"date":"2021-02-01","event":"LayerZero Labs co-founded by Bryan Pellegrino, Caleb Banister, and Ryan Zarick.","source":"Crunchbase / Sequoia Capital profile","source_url":"https://sequoiacap.com/article/bryan-pellegrino-spotlight-layerzero"},{"date":"2024-06-01","event":"ZRO token launched with 'Proof of Donation' claiming mechanism; token drops 24% on launch day amid community backlash.","source":"FXStreet","source_url":"https://www.fxstreet.com/cryptocurrencies/news/layerzero-zro-token-tumbles-24-in-24-hours-hit-by-airdrop-related-controversy-202406210930"},{"date":"2026-02-10","event":"LayerZero Labs announces 'Zero' Layer 1 blockchain backed by Citadel Securities, DTCC, ICE, ARK Invest, and Google Cloud.","source":"BusinessWire","source_url":"https://www.businesswire.com/news/home/20260210491975/en/LayerZero-Announces-Zero-Blockchain-to-Build-Global-Market-Infrastructure-In-Collaboration-with-Citadel-Securities-The-Depository-Trust-Clearing-Corporation-Intercontinental-Exchange-With-Strategic-Investment-in-ZRO-from-Citadel-Securities"},{"date":"2026-03-06","event":"Attacker socially engineers a LayerZero Labs developer, harvesting session keys and gaining access to LayerZero's internal RPC cloud environment. Compromised RPC nodes are seeded with poisoned data.","source":"LayerZero Labs KelpDAO Incident Report PDF","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-04-18","event":"$292 million KelpDAO rsETH bridge exploit occurs. Attacker uses poisoned LayerZero RPC nodes and the bridge's 1-of-1 DVN configuration to forge and validate a cross-chain message, releasing 116,500 rsETH.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-20","event":"LayerZero Labs issues statement attributing the exploit to KelpDAO's application-level configuration choices, and attributes the attack to North Korea's Lazarus Group.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-05-05","event":"KelpDAO publicly states that LayerZero personnel had approved KelpDAO's single-verifier configuration before the exploit.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-07","event":"Solv Protocol announces it is moving approximately $700 million in tokenized bitcoin from LayerZero to Chainlink CCIP.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/05/07/solv-drops-layerzero-for-chainlink-ccip-in-usd700-million-tokenized-bitcoin-migration"},{"date":"2026-05-09","event":"LayerZero Labs formally admits it 'made a mistake,' acknowledging that its DVN should not have been permitted to act as a single verifier for high-value transactions. The company states: 'We own that.'","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-05-15","event":"Approximately $4 billion in assets across multiple protocols have migrated from LayerZero to Chainlink CCIP, including Lombard.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/05/15/lombard-joins-layerzero-exodus-as-usd4-billion-in-assets-switch-to-chainlink-s-bridge"},{"date":"2026-05-18","event":"LayerZero Labs publishes its formal KelpDAO incident report PDF detailing the technical timeline of the March–April 2026 breach.","source":"LayerZero (official)","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-08-04","event":"BitGo's decision to migrate WBTC ($7.4 billion) pushes publicly announced LayerZero-to-Chainlink migrations to nearly $15 billion.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/08/04/bitgo-s-wbtc-move-pushes-layerzero-to-chainlink-tally-near-usd15-billion"},{"date":"2026-08-18","event":"The state of Wyoming joins the migration, moving its stablecoin infrastructure away from LayerZero.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/08/18/wyoming-joins-usd15-billion-layerzero-exodus-with-state-stablecoin-move"}]},"v":1}