LayerZero: KelpDAO Hit by Exploit, About $290M Lost; Initial Signs Point to North Korea's Lazarus Group

LayerZero said KelpDAO was exploited on April 18, 2026, with estimated losses of about $290 million. The incident is preliminarily attributed to the DPRK-linked Lazarus Group (TraderTraitor). According to LayerZero, the attacker poisoned downstream RPC endpoints used by the DVN. A concurrent DDoS campaign triggered failover, leading the DVN to validate transactions that never occurred. LayerZero said no protocol flaws or key compromises were involved. The root cause was KelpDAO's 1/1 DVN configuration, which created a single point of failure. The impact was contained to rsETH, with no broader spillover reported. Affected RPCs have been replaced, and the LayerZero Labs DVN is now back online.