TLDR Tech / Crypto
LayerZero Discloses Lazarus Attack on RPCs Behind Kelp Exploit
Lazarus Group hit LayerZero Labs' internal RPCs on April 19 via RPC poisoning paired with a DDOS on their external RPC provider, exploiting Kelp DAO's 1/1 DVN configuration and affecting a single application representing 0.14% of deployed apps and 0.36% of total bridged value, while the core protocol processed $9B+ in volume post-incident. LayerZero Labs has since removed support for 1/1 DVN configurations, shifted defaults to 5/5 with a 3/3 minimum, and begun building a Rust-based DVN client to reduce client monoculture. The team released OneSig, a custom multisig with local Merkle hashing that blocks backend transaction substitution, and raised their signing threshold from 3/5 to 7/10 across all chains. LayerZero recommends developers pin configurations away from defaults, run 2-5 DVNs, and consider operating their own DVN.
Read the full story