🚨 Kelp DAO hacked $290M: LayerZero blames Kelp, suspects North Korean Lazarus behind it
On April 18, hackers withdrew approximately $290M from Kelp DAO through a bridge running on LayerZero. This is the largest DeFi hack of 2026, and I see this as a very worthy case study.
The attack method was quite sophisticated:
→ Hackers infiltrated 2 RPC nodes that the LayerZero verifier was using, installing spoofing software
→ The software only lied to the verifier (pretending fake transactions were real), while still providing correct data to all other systems, so no one suspected
→ Simultaneously, they launched a DDoS attack to take down the backup nodes, leaving the verifier without any sources for cross-checking
Result: the verifier was left with only 2 manipulated nodes, approving fake transactions, and the money was completely drained.
Why does LayerZero blame Kelp?
→ Kelp only used a single verification set (configured 1/1 DVN)
→ Simply put: instead of 3 people co-signing the money transfer, Kelp only relied on 1 person, and the hacker fooled that person to succeed
→ LayerZero claims they have advised Kelp multiple times to use independent multiple DVNs, but Kelp did not listen
What chills me is the name behind it. LayerZero believes it is likely the Lazarus group from North Korea (TraderTraitor unit), which is also the group that hacked Drift Protocol on April 1. In total, within 18 days, Lazarus withdrew over $575M from DeFi using two completely different attack methods.
📊 Personal assessment:
→ This is why last week I saw $AXL pump 30%, the narrative of cross-chain security is not a joke
→ The real risk does not lie in LayerZero itself but in how developers configure security; 1/1 DVN essentially voluntarily opens the door for hackers
→ For DeFi investors, I think this is the time to start reading the security specs of each protocol carefully, not just looking at APY
→ LayerZero has announced it will refuse to serve any projects still using 1/1 DVN, this is the right step
Kelp DAO has not yet responded. Are you holding any DeFi tokens that bridge through LayerZero? I think you should check the DVN configuration before sleeping well.
$ETH $BTC #DeFi
On April 18, hackers withdrew approximately $290M from Kelp DAO through a bridge running on LayerZero. This is the largest DeFi hack of 2026, and I see this as a very worthy case study.
The attack method was quite sophisticated:
→ Hackers infiltrated 2 RPC nodes that the LayerZero verifier was using, installing spoofing software
→ The software only lied to the verifier (pretending fake transactions were real), while still providing correct data to all other systems, so no one suspected
→ Simultaneously, they launched a DDoS attack to take down the backup nodes, leaving the verifier without any sources for cross-checking
Result: the verifier was left with only 2 manipulated nodes, approving fake transactions, and the money was completely drained.
Why does LayerZero blame Kelp?
→ Kelp only used a single verification set (configured 1/1 DVN)
→ Simply put: instead of 3 people co-signing the money transfer, Kelp only relied on 1 person, and the hacker fooled that person to succeed
→ LayerZero claims they have advised Kelp multiple times to use independent multiple DVNs, but Kelp did not listen
What chills me is the name behind it. LayerZero believes it is likely the Lazarus group from North Korea (TraderTraitor unit), which is also the group that hacked Drift Protocol on April 1. In total, within 18 days, Lazarus withdrew over $575M from DeFi using two completely different attack methods.
📊 Personal assessment:
→ This is why last week I saw $AXL pump 30%, the narrative of cross-chain security is not a joke
→ The real risk does not lie in LayerZero itself but in how developers configure security; 1/1 DVN essentially voluntarily opens the door for hackers
→ For DeFi investors, I think this is the time to start reading the security specs of each protocol carefully, not just looking at APY
→ LayerZero has announced it will refuse to serve any projects still using 1/1 DVN, this is the right step
Kelp DAO has not yet responded. Are you holding any DeFi tokens that bridge through LayerZero? I think you should check the DVN configuration before sleeping well.
$ETH $BTC #DeFi