LayerZero Hack: Lazarus Group Blamed for Devastating $290M Kelp DAO Exploit

In a major cybersecurity alert for the decentralized finance (DeFi) sector, cross-chain interoperability protocol LayerZero has formally attributed a massive $290 million exploit of Kelp DAO to the notorious North Korean state-sponsored hacking collective, Lazarus Group. The announcement, made via LayerZero’s official social media channels on April 10, 2025, details a sophisticated attack vector that compromised the protocol’s underlying infrastructure, marking one of the most significant crypto heists of the year and raising urgent questions about validator security in cross-chain systems.

LayerZero Hack Details: A Sophisticated Infrastructure Attack

The attackers executed a multi-stage assault on the Decentralized Verification Network (DVN), a critical component of LayerZero’s architecture that validates cross-chain messages. According to the protocol’s forensic report, the Lazarus Group operatives did not target a smart contract bug. Instead, they focused on the Remote Procedure Call (RPC) node infrastructure. First, the hackers compromised two independent RPC nodes. Subsequently, they replaced their legitimate software with malicious binaries designed to intercept and manipulate transaction data. To complete the takeover, the attackers launched a distributed denial-of-service (DDoS) attack against normal, functioning nodes. This barrage of traffic effectively disabled them, forcing the entire system to rely on the now-compromised malicious nodes. Consequently, this redirection allowed the hackers to authorize fraudulent cross-chain transactions, draining rsETH (Kelp’s liquid staking token) from the DAO’s contracts.

Kelp DAO Exploit: The $290 Million Consequence

The immediate financial impact of the infrastructure compromise was catastrophic for Kelp DAO. The attackers successfully siphoned approximately $290 million worth of rsETH. This token represents staked Ethereum across various liquid staking protocols. The heist triggered massive sell-pressure on decentralized exchanges, causing temporary price volatility. LayerZero’s post-mortem analysis emphasized a critical security configuration issue. The protocol had previously recommended that Kelp DAO employ a multi-DVN setup. This configuration uses multiple independent validators to secure messages, creating redundancy. However, Kelp DAO maintained a single-validator structure for its rsETH operations. This decision created a single point of failure. The vulnerability was specific to Kelp DAO’s application configuration on LayerZero. Importantly, LayerZero stated no other assets or applications on its network were affected by this specific incident.

The Lazarus Group’s Evolving Crypto Playbook

Attribution to the Lazarus Group, also known as APT38, carries significant geopolitical weight. Cybersecurity firms like Chainalysis and Mandiant consistently track the group’s activities. They identify Lazarus as a primary financier for North Korea’s weapons programs. The group’s tactics have evolved from simple phishing to highly complex infrastructure attacks. For instance, the 2022 Ronin Bridge hack netted over $600 million using compromised private keys. Similarly, the 2023 Atomic Wallet attack involved a sophisticated supply chain compromise. The LayerZero attack represents a further evolution, targeting the node infrastructure layer of a cross-chain protocol rather than an application’s smart contract code. This shift indicates a deep understanding of blockchain architecture and highlights the need for defense-in-depth strategies across the entire tech stack.

Cross-Chain Bridge Security Under Microscope

The incident immediately reignites the long-standing debate about the security of cross-chain bridges. These protocols, which lock assets on one chain and mint representations on another, have become prime targets due to the immense value they custody. A comparison of major bridge hacks reveals a pattern:

• Ronin Bridge (2022): $625M stolen via compromised validator keys.
• Wormhole (2022): $326M stolen via a signature verification flaw.
• Nomad Bridge (2022): $190M stolen due to a reusable approval bug.
• LayerZero/Kelp DAO (2025): $290M stolen via RPC node compromise.

This attack vector—compromising the off-chain infrastructure that feeds data to on-chain contracts—presents a new challenge. It moves the battlefield from the immutable code of the blockchain to the mutable servers and nodes in traditional data centers. Consequently, security audits must expand beyond smart contracts to include the entire oracle and validation network.

Response, Recovery, and Regulatory Implications

LayerZero’s response team acted swiftly following the detection of anomalous activity. The compromised RPC nodes were immediately isolated and replaced. Service across the network was restored within hours. The company is now collaborating with international law enforcement agencies, blockchain intelligence firms like TRM Labs and Elliptic, and centralized exchanges to trace and potentially freeze the stolen funds. This collaboration is crucial, as Lazarus Group typically uses complex chains of transactions through mixers like Tornado Cash and cross-chain swaps to obfuscate the trail. From a regulatory standpoint, this attack will likely accelerate discussions in jurisdictions like the United States and the European Union around imposing stricter security standards for cross-chain protocols and holding DAOs to higher accountability for their configuration choices.

Conclusion

The $290 million LayerZero hack attributed to the Lazarus Group underscores a pivotal moment in DeFi security. It demonstrates that threats are no longer confined to smart contract logic but extend to the foundational infrastructure that supports cross-chain communication. While LayerZero maintains the core protocol remains sound, the incident highlights the critical importance of application-layer security configurations, such as employing multi-validator setups. For the broader industry, this event serves as a stark reminder that nation-state actors are continuously refining their tactics, and the ecosystem’s defense mechanisms must evolve even faster to protect user assets. The ongoing investigation and fund-tracking efforts will be closely watched as a test case for international cooperation against crypto-enabled cybercrime.

FAQs

Q1: Was the LayerZero protocol itself hacked?
A1: No. LayerZero’s analysis states the vulnerability was a security configuration issue specific to how Kelp DAO set up its application on the network, not a fundamental flaw in the LayerZero protocol’s code. Other applications using LayerZero were not affected.

Q2: What is an RPC node, and why was it a target?
A2: An RPC (Remote Procedure Call) node is a server that provides data to blockchain applications. In this case, LayerZero’s DVN uses RPC nodes to fetch and verify state information from different chains. By hacking these nodes, the attackers could feed false data to the system, authorizing fraudulent transactions.

Q3: What is the Lazarus Group, and why do they target crypto?
A3: The Lazarus Group is a cybercrime unit linked to North Korea’s Reconnaissance General Bureau. They target cryptocurrency because it provides a method to bypass international financial sanctions and generate foreign currency for the regime, often to fund its military and weapons programs.

Q4: What is a multi-DVN setup, and how could it have helped?
A4: A multi-DVN setup requires multiple, independent validation networks to agree on the state of a transaction before it is approved. This creates redundancy. If one DVN (or its RPC nodes) is compromised, the others can identify the discrepancy and prevent the fraudulent transaction from being finalized.

Q5: Can the stolen funds from the Kelp DAO exploit be recovered?
A5: Recovery is difficult but not impossible. LayerZero is working with blockchain analytics firms and exchanges to trace the funds. If the stolen assets are moved to a centralized exchange that cooperates with authorities, they could potentially be frozen. However, the Lazarus Group is highly skilled at using privacy tools and decentralized exchanges to launder funds.