According to Foresight News, LayerZero released a statement saying that on April 18, KelpDAO suffered an attack of approximately $290 million, initially assessed to be the work of a highly sophisticated state actor (suspected to be TraderTraitor, a subsidiary of the North Korean Lazarus Group). This attack was completely isolated from KelpDAO's rsETH configuration and was due to its use of a single DVN (Decentralized Verifier Network) setup. The LayerZero protocol itself was not exploited, and no other cross-chain assets or applications were affected. The core of the attack was through the contamination of the downstream RPC infrastructure relied upon by LayerZero DVN. Currently, LayerZero has decommissioned all affected RPC nodes and completed their replacement, and the DVN has resumed normal operations.

LayerZero emphasizes that its modular security architecture allows each application to independently configure DVN combinations, with industry best practices advocating for multiple DVN redundancy settings to avoid single points of failure. KelpDAO has previously received multiple suggestions for multi-DVN configurations but insists on using a 1-of-1 configuration. Additionally, the official entity has collaborated with several global law enforcement agencies and actively supports funding traceability efforts. The LayerZero protocol is functioning normally as designed, with no protocol-level vulnerabilities detected.