Verify a decision

{"actor":"system:backfill","investigation_id":"25915170-3945-4e6e-8bb9-f8c79fc1d7e0","kind":"publish","page_slug":"layerzero-bridge-protocol-liability","published_at":"2026-10-16T12:11:59.401Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LayerZero (Bridge Protocol Liability)","sections":[{"content":"LayerZero is an omnichain messaging protocol that allows decentralized applications to pass messages and transfer assets across supported blockchains. The protocol, governed by LayerZero Labs Ltd. (incorporated in Vancouver, British Columbia), was founded in February 2021 by Bryan Pellegrino (CEO), Ryan Zarick (CTO), and Caleb Banister. The V2 iteration of the protocol introduced Decentralized Verifier Networks (DVNs), replacing the earlier Oracle-Relayer model. Under the DVN architecture, application developers select one or more independent off-chain operators to attest to cross-chain message validity; the LayerZero Endpoint contract on each chain enforces that all chosen verifiers agree before a message is accepted. As of April 2026, more than 50 DVN operators participated in the network, including LayerZero Labs itself, Google Cloud, Polyhedra Network, Nethermind, and Animoca. The protocol's native governance token, ZRO, launched on June 20, 2024, with a total supply of 1 billion tokens distributed via a controversial 'Proof of Donation' mechanism.","heading":"Overview and Protocol Architecture","severity":"low","sources":[{"credibility":2,"name":"LayerZero V2 Technical Paper (arXiv)","type":"research","url":"https://arxiv.org/pdf/2312.09118"},{"credibility":2,"name":"LayerZero V2: Explaining DVNs (Official Blog)","type":"official","url":"https://layerzero.network/blog/layerzero-v2-explaining-dvns"},{"credibility":2,"name":"Bryan Pellegrino — Sequoia Capital Profile","type":"news_article","url":"https://sequoiacap.com/article/bryan-pellegrino-spotlight-layerzero"}]},{"content":"On April 18, 2026, at approximately 17:30 UTC, an attacker drained approximately 116,500 rsETH (valued at roughly $292 million, representing approximately 18% of circulating rsETH supply) from KelpDAO's cross-chain bridge, which was built on LayerZero V2. This was the largest individual DeFi exploit recorded in 2026 as of the time of reporting. The attack was not a direct smart contract vulnerability. According to LayerZero's post-mortem published April 20, 2026, attackers compromised two RPC nodes that LayerZero Labs' own DVN relied upon to verify cross-chain messages. The compromised nodes were programmed to present falsified transaction data exclusively to the LayerZero DVN verifier while appearing normal to all other observers, evading standard monitoring. A simultaneous DDoS attack forced the DVN to fail over to the compromised infrastructure. The attacker then submitted a forged LayerZero V2 packet, which the compromised DVN incorrectly validated as legitimate, authorizing the minting of 116,500 unbacked rsETH tokens. An emergency freeze by KelpDAO's multisig was enacted approximately 46 minutes after the attack began. LayerZero attributed the attack with 'preliminary confidence' to North Korea's Lazarus Group, specifically its TraderTraitor subunit, citing overlap with the contemporaneous $285 million Drift Protocol exploit. This attribution has not been independently confirmed by law enforcement or a court as of October 2026 and should be treated as an allegation. A critical enabling factor was KelpDAO's use of a 1-of-1 DVN configuration — meaning LayerZero Labs was the sole verifier for the rsETH bridge — which created a single point of failure. LayerZero's initial response attributed full responsibility to KelpDAO's configuration choices. On May 9, 2026, LayerZero issued a public apology and reversed course, admitting it 'should not have allowed its DVN to act as a sole verifier for high-value transactions' and acknowledging a failure in communications over the preceding three weeks. LayerZero subsequently banned 1-of-1 DVN configurations and committed to migrating to multi-verifier defaults (5/5 or 3/3 configurations).","heading":"April 2026 KelpDAO Exploit ($292 Million)","severity":"critical","sources":[{"credibility":1,"name":"LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"credibility":2,"name":"KelpDAO & LayerZero: Incident Report — Nexus Mutual","type":"research","url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report"},{"credibility":2,"name":"LayerZero Post Mortem Shows Lazarus Group Stole $290M — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":1,"name":"LayerZero Issues Public Apology, Admits Fault in Single-Verifier Setup — The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-05-09-layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup-400629"}]},{"content":"On September 25, 2026, Evercrest Technologies (the company that develops KelpDAO) filed a notice of civil claim in the Supreme Court of British Columbia against LayerZero Labs and co-founder and CEO Bryan Pellegrino personally. KelpDAO alleged that LayerZero reviewed and endorsed in writing the specific 1-of-1 DVN configuration used by the exploited rsETH bridge prior to deployment, while allegedly failing to disclose known weaknesses and risks inherent in that setup. KelpDAO stated: 'The exploit was a direct result of LayerZero's failures, including a failure to disclose weaknesses and risks inherent in LayerZero's own technology.' Bryan Pellegrino disputed the allegations, stating 'The claim continues to be meritless,' and separately disputed Kelp's account of the original configuration — asserting that Kelp had initially used a multi-DVN or DeadDVN default before switching the rsETH deployment to the single-verifier setup that LayerZero later identified as a single point of failure. As of October 2026, the lawsuit remained pending and no court ruling on the merits had been issued. All allegations in the complaint remain unproven.","heading":"KelpDAO Civil Lawsuit (Pending, No Adjudication)","severity":"high","sources":[{"credibility":1,"name":"KelpDAO sues LayerZero and CEO over $292M rsETH bridge exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far"},{"credibility":1,"name":"KelpDAO sues LayerZero, claims it endorsed setup used in $292M rsETH exploit — The Block","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-09-25-kelpdao-sues-layerzero-claims-it-endorsed-setup-used-in-292-million-rseth-exploit-416361"},{"credibility":1,"name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":2,"name":"KelpDAO Is Suing LayerZero and Its CEO Bryan Pellegrino in Canada Over $292M Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/25/kelpdao-sues-layerzero-and-ceo-bryan-pellegrino-in-canada-over-292m-rseth-exploit/"}]},{"content":"Following the KelpDAO exploit, analysis of Dune Analytics data revealed that approximately 47% of roughly 2,665 active LayerZero OApp contracts had been running a 1-of-1 DVN configuration over a 90-day period ending around April 22, 2026, with more than $4.5 billion in associated market value exposed to the same class of single-point-of-failure risk that enabled the KelpDAO exploit. An additional 45% used a 2-of-2 configuration; only 5% employed 3-of-3 or higher. The concentration of risk in minimal-security configurations reflected the protocol's historical default settings. LayerZero responded to this finding by announcing it would no longer sign messages for any application running a 1-of-1 configuration, effective immediately, and began migration efforts across the ecosystem.","heading":"Ecosystem-Wide DVN Security Deficiency (47% of OApps)","severity":"high","sources":[{"credibility":2,"name":"Dune Analysis Shows 47% of LayerZero OApps Use the Lowest 1-of-1 DVN Security — The Defiant","type":"research","url":"https://thedefiant.io/news/security/dune-layerzero-oapp-dvn-security-analysis-1bklaq"},{"credibility":2,"name":"47% of LayerZero OApps at Risk After $292M Kelp DAO Hack — MEXC","type":"news_article","url":"https://www.mexc.com/news/1051837"}]},{"content":"Security researchers and auditors have raised structural concerns about LayerZero's trust model since the protocol's early versions. In the original V1 design, LayerZero's security relied on the independence of an Oracle and a Relayer; L2Beat published analysis noting that if both components were controlled by the same party (or colluded), an attacker could forge both a block header and a transaction proof simultaneously, since the model's collusion-resistance depended on social trust and economic incentives rather than cryptographic enforcement. L2Beat further noted that the permissive application-level security configuration model — where each OApp can freely define its own security policy — increases risk surface for end users, who bear the burden of validating the security posture of every application they interact with. The KelpDAO exploit validated a specific instance of this concern: LayerZero Labs' own infrastructure served as the sole verifier for a bridge holding hundreds of millions of dollars, making the protocol's own off-chain operations the single point of failure. A January 2023 allegation by James Prestwich (founder of the Nomad bridge protocol) alleged that LayerZero's Endpoint and UltraLightNodeV2 contracts contained a 'backdoor' allowing the LayerZero MultiSig to pass arbitrary messages without Oracle or Relayer sign-off. LayerZero CEO Bryan Pellegrino acknowledged the capability existed but denied it was hidden, stating it was disclosed and that developers could configure parameters to restrict LayerZero's special access. The 2023 dispute was not adjudicated and no regulatory action followed. Post-KelpDAO, LayerZero's partial admission on May 9, 2026, that it should not have permitted solo-verifier configurations for high-value deployments represented a substantive acknowledgment of protocol-level governance risk.","heading":"Centralization and Trust-Model Concerns","severity":"high","sources":[{"credibility":2,"name":"Circumventing Layer Zero: Why Isolated Security is No Security — L2Beat (Medium)","type":"research","url":"https://medium.com/l2beat/circumventing-layer-zero-5e9f652a5d3e"},{"credibility":1,"name":"Bridge Platform LayerZero Denies Allegations It Kept 'Backdoor' Secret — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/01/30/bridge-platform-layerzero-denies-allegations-it-kept-backdoor-secret"},{"credibility":1,"name":"LayerZero CEO denies accusations of critical trusted third-party vulnerabilities — The Block","type":"news_article","url":"https://www.theblock.co/post/206770/layerzero-ceo-denies-accusations-of-critical-trusted-third-party-vulnerabilities"},{"credibility":2,"name":"Kelp Exploit Exposes Centralization in LayerZero — Phemex","type":"news_article","url":"https://phemex.com/news/article/kelp-exploit-highlights-centralization-risk-in-layerzero-infrastructure-74978"}]},{"content":"On March 28, 2024, LayerZero updated the verification contract (MPTValidatorV2) used for cross-chain transactions without any public announcement. Cobo Blockchain Security Team subsequently published analysis confirming the update patched a critical vulnerability present in the prior MPTValidator contract: a flaw allowing a malicious relayer to forge cross-chain messages by manipulating receipt data within the Merkle Patricia Trie (MPT) proof, thereby breaking a core security assumption of the protocol. LayerZero did not publicly disclose the vulnerability or the patch at the time of deployment. The silent patching practice drew criticism from security researchers concerned about transparency.","heading":"Silent Security Patch (March 2024)","severity":"medium","sources":[{"credibility":2,"name":"Cobo Blockchain Security Team's analysis of the LayerZero/Stargate vulnerability — Cobo (Medium)","type":"research","url":"https://medium.com/@Cobo_Global/cobo-blockchain-security-teams-take-on-the-vulnerability-in-stargate-s-underlying-protocol-b993d36ffdb6"}]},{"content":"LayerZero launched its ZRO governance token on June 20, 2024, distributing tokens to approximately 1.28 million eligible wallets. Prior to launch, the protocol flagged and excluded over 803,000 addresses as suspected sybils engaged in airdrop farming. The claiming mechanism — branded 'Proof of Donation' — required each eligible recipient to pay 10 cents per ZRO token in USDC, USDT, or ETH, with proceeds directed to the Protocol Guild (an Ethereum core developer collective). The mechanism generated widespread community backlash; critics argued that requiring payment to claim allocated tokens converted the distribution into a de facto initial coin offering (ICO). LayerZero's team maintained that the distribution was 'not an airdrop.' The ZRO token fell approximately 24% within 24 hours of launch amid the controversy. No regulatory action was identified in connection with the token launch as of October 2026.","heading":"ZRO Token Airdrop Controversy (June 2024)","severity":"low","sources":[{"credibility":2,"name":"LayerZero ZRO token airdrop goes live with a controversial claiming mechanism — FXStreet","type":"news_article","url":"https://www.fxstreet.com/cryptocurrencies/news/layerzero-zro-token-tumbles-24-in-24-hours-hit-by-airdrop-related-controversy-202406210930"},{"credibility":2,"name":"ZRO token falls 17% amid controversy over LayerZero's 'not an airdrop' — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/layerzero-zro-cryptocurrency-token-donation-launch-controversy"},{"credibility":2,"name":"LayerZero flags over 800k sybil addresses in airdrop farming crackdown — Invezz","type":"news_article","url":"https://invezz.com/news/2024/05/20/layerzero-flags-over-800k-sybil-addresses-in-airdrop-farming-crackdown/"}]},{"content":"On July 15, 2026, blockchain security firm PeckShield reported that LayerZero Core Executor wallets had been drained of approximately $2.4 million across eight blockchain networks including BNB Chain, Base, Ethereum, Optimism, Avalanche, Arbitrum, Plasma, and Mantle, with assets converted to approximately 956 ETH and $322,000 in USDC. LayerZero Labs subsequently clarified on the same day that the transactions were routine internal inventory rebalancing and not an attack, stating that no user funds were at risk. The claim of an exploit was not substantiated. PeckShield's initial alert was not retracted at the time of reporting, but LayerZero's denial was widely reported. This incident is included for completeness; it should not be treated as a confirmed exploit.","heading":"July 2026 Executor Wallet Incident (False Alarm)","severity":"low","sources":[{"credibility":2,"name":"LayerZero Confirms $2.4M Executor Wallet Transfers Were Routine Rebalancing, Not Hack — Bitget","type":"news_article","url":"https://www.bitget.com/news/detail/12560605506856"},{"credibility":3,"name":"Suspected $2.4 Million Exploit Targets LayerZero Executor Wallets — Hokanews","type":"news_article","url":"https://www.hokanews.com/2026/07/suspected-24-million-exploit-targets.html"}]},{"content":"Following the KelpDAO exploit and public backlash, LayerZero Labs announced a series of security policy changes as of May 2026. The protocol banned 1-of-1 DVN configurations and began migrating active deployments to multi-verifier defaults. LayerZero stated it would refuse to sign messages for any OApp running a single-verifier setup. The protocol also accelerated its integration with the EigenLayer CryptoEconomic DVN framework, which introduces economic slashing conditions for DVN operators. LayerZero launched a $15 million bug bounty program via Immunefi (reported as record-breaking at the time of announcement) as an additional security measure. These reforms address structural gaps identified in the exploit but had not yet been independently audited for completeness as of October 2026.","heading":"Post-Exploit Security Reforms","severity":"medium","sources":[{"credibility":2,"name":"LayerZero x EigenLayer: The CryptoEconomic DVN Framework — LayerZero Blog","type":"official","url":"https://layerzero.network/blog/layerzero-x-eigenlayer-cryptoeconomic-dvn"},{"credibility":2,"name":"LayerZero launches record-breaking $15M crypto bug bounty program — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/layerzero-launches-record-breaking-15m-crypto-bug-bounty-program/"},{"credibility":2,"name":"LayerZero Admits Fault in Single-Verifier Setup, Pledges Overhaul — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"}]}],"sources_used":[{"credibility":1,"name":"LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"credibility":1,"name":"KelpDAO sues LayerZero and CEO over $292M rsETH bridge exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far"},{"credibility":1,"name":"KelpDAO sues LayerZero, claims it endorsed setup used in $292M rsETH exploit — The Block","type":"news_article","url":"https://www.theblock.co/news/regulation/2026-09-25-kelpdao-sues-layerzero-claims-it-endorsed-setup-used-in-292-million-rseth-exploit-416361"},{"credibility":1,"name":"LayerZero Issues Public Apology, Admits Fault in Single-Verifier Setup — The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-05-09-layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup-400629"},{"credibility":1,"name":"Bridge Platform LayerZero Denies Allegations It Kept 'Backdoor' Secret — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/01/30/bridge-platform-layerzero-denies-allegations-it-kept-backdoor-secret"},{"credibility":1,"name":"LayerZero CEO denies accusations of critical trusted third-party vulnerabilities — The Block","type":"news_article","url":"https://www.theblock.co/post/206770/layerzero-ceo-denies-accusations-of-critical-trusted-third-party-vulnerabilities"},{"credibility":1,"name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":2,"name":"KelpDAO & LayerZero: Incident Report — Nexus Mutual","type":"research","url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":2,"name":"Dune Analysis Shows 47% of LayerZero OApps Use the Lowest 1-of-1 DVN Security — The Defiant","type":"research","url":"https://thedefiant.io/news/security/dune-layerzero-oapp-dvn-security-analysis-1bklaq"},{"credibility":2,"name":"Circumventing Layer Zero: Why Isolated Security is No Security — L2Beat (Medium)","type":"research","url":"https://medium.com/l2beat/circumventing-layer-zero-5e9f652a5d3e"},{"credibility":2,"name":"Cobo Blockchain Security Team's analysis of the LayerZero/Stargate vulnerability","type":"research","url":"https://medium.com/@Cobo_Global/cobo-blockchain-security-teams-take-on-the-vulnerability-in-stargate-s-underlying-protocol-b993d36ffdb6"},{"credibility":2,"name":"ZRO token falls 17% amid controversy over LayerZero's 'not an airdrop' — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/layerzero-zro-cryptocurrency-token-donation-launch-controversy"},{"credibility":2,"name":"LayerZero flags over 800k sybil addresses in airdrop farming crackdown — Invezz","type":"news_article","url":"https://invezz.com/news/2024/05/20/layerzero-flags-over-800k-sybil-addresses-in-airdrop-farming-crackdown/"},{"credibility":2,"name":"LayerZero V2 Technical Paper — arXiv","type":"research","url":"https://arxiv.org/pdf/2312.09118"},{"credibility":2,"name":"LayerZero V2: Explaining DVNs — LayerZero Official Blog","type":"official","url":"https://layerzero.network/blog/layerzero-v2-explaining-dvns"},{"credibility":2,"name":"LayerZero x EigenLayer CryptoEconomic DVN Framework — LayerZero Official Blog","type":"official","url":"https://layerzero.network/blog/layerzero-x-eigenlayer-cryptoeconomic-dvn"},{"credibility":2,"name":"LayerZero launches $15M bug bounty program — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/layerzero-launches-record-breaking-15m-crypto-bug-bounty-program/"},{"credibility":2,"name":"LayerZero Post Mortem Shows Lazarus Group Stole $290M — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3"},{"credibility":2,"name":"Bryan Pellegrino — Sequoia Capital Profile","type":"news_article","url":"https://sequoiacap.com/article/bryan-pellegrino-spotlight-layerzero"},{"credibility":2,"name":"LayerZero Confirms $2.4M Executor Wallet Transfers Were Routine Rebalancing — Bitget","type":"news_article","url":"https://www.bitget.com/news/detail/12560605506856"}],"summary":"LayerZero is an omnichain interoperability protocol enabling cross-chain messaging, developed by LayerZero Labs (Vancouver, BC) and founded in 2021 by Bryan Pellegrino, Ryan Zarick, and Caleb Banister. The protocol suffered significant reputational and financial damage following the April 2026 KelpDAO exploit, in which approximately $292 million in rsETH was stolen via a compromised single-verifier configuration; LayerZero subsequently issued a public apology admitting partial fault. A civil lawsuit filed in the Supreme Court of British Columbia by KelpDAO against LayerZero Labs and CEO Bryan Pellegrino was pending as of October 2026, with no court adjudication yet reached.","timeline":[{"date":"2021-02-01","event":"LayerZero Labs founded by Bryan Pellegrino, Ryan Zarick, and Caleb Banister in Vancouver, British Columbia.","source":"Sequoia Capital Profile","source_url":"https://sequoiacap.com/article/bryan-pellegrino-spotlight-layerzero"},{"date":"2023-01-30","event":"James Prestwich (Nomad bridge founder) alleged LayerZero's Endpoint and UltraLightNodeV2 contracts contained an undisclosed 'backdoor' permitting the LayerZero MultiSig to pass arbitrary messages. LayerZero CEO Bryan Pellegrino acknowledged the capability but denied it was hidden. No regulatory action followed.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/01/30/bridge-platform-layerzero-denies-allegations-it-kept-backdoor-secret"},{"date":"2024-03-28","event":"LayerZero silently updated the MPTValidator verification contract to MPTValidatorV2, patching a critical vulnerability discovered by Cobo Security Team that allowed a malicious relayer to forge cross-chain messages via manipulated MPT proof data. No public disclosure was made at the time.","source":"Cobo Blockchain Security Team","source_url":"https://medium.com/@Cobo_Global/cobo-blockchain-security-teams-take-on-the-vulnerability-in-stargate-s-underlying-protocol-b993d36ffdb6"},{"date":"2024-06-20","event":"ZRO governance token launched to approximately 1.28 million eligible wallets via a 'Proof of Donation' mechanism requiring 10 cents per token. Over 803,000 addresses were excluded as sybils. ZRO fell approximately 24% within 24 hours amid community backlash over the pay-to-claim structure.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/layerzero-zro-cryptocurrency-token-donation-launch-controversy"},{"date":"2026-04-18","event":"KelpDAO's rsETH cross-chain bridge, built on LayerZero V2 with a 1-of-1 DVN configuration, was exploited for approximately $292 million (116,500 rsETH). Attackers, preliminarily attributed by LayerZero to the Lazarus Group's TraderTraitor subunit, compromised two RPC nodes used by LayerZero's own DVN. A simultaneous DDoS forced failover to the compromised nodes, enabling fraudulent message validation and unbacked rsETH minting.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04-20","event":"LayerZero published its post-mortem attributing the KelpDAO exploit to North Korea's Lazarus Group (TraderTraitor subunit) with 'preliminary confidence,' while placing primary responsibility on KelpDAO's 1-of-1 DVN configuration choice.","source":"The Defiant","source_url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3"},{"date":"2026-05-05","event":"KelpDAO publicly claimed that LayerZero had reviewed and endorsed in writing the 1-of-1 verifier configuration that LayerZero's post-mortem blamed for the exploit.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-09","event":"LayerZero issued a public apology, reversing its initial stance by admitting it should not have permitted its DVN to act as a sole verifier for high-value transactions. LayerZero announced a ban on 1-of-1 DVN configurations and migration to multi-verifier defaults.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-05-09-layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup-400629"},{"date":"2026-07-15","event":"PeckShield alleged that LayerZero Core Executor wallets were drained of $2.4 million across eight chains. LayerZero Labs clarified on the same day that the transfers were routine internal fund rebalancing, not an exploit. No user funds were lost.","source":"Bitget News","source_url":"https://www.bitget.com/news/detail/12560605506856"},{"date":"2026-09-25","event":"Evercrest Technologies (KelpDAO developer) filed a notice of civil claim in the Supreme Court of British Columbia against LayerZero Labs and CEO Bryan Pellegrino personally, seeking damages related to the $292 million rsETH exploit. The lawsuit was pending with no court ruling on the merits as of October 2026.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far"}]},"v":1}