SlowMist's Yu Xian: KelpDAO's $290M Theft Tied to Targeted RPC Poisoning and LayerZero DVN Message Forgery

SlowMist founder Yu Xian (@evilcos) said the $290 million theft involving KelpDAO stemmed from a targeted poisoning attack on the downstream RPC infrastructure used by LayerZero's Decentralized Verifier Network (DVN). He outlined the attack as starting with the perpetrators identifying the set of RPC nodes relied on by the LayerZero DVN, then breaching two separate clusters and swapping in modified opgeth binaries. The compromised nodes used selective deception: they served forged, malicious payloads only to the DVN while returning normal data to other IP addresses. At the same time, the attackers launched DDoS attacks against the remaining uncompromised RPC nodes, pushing the DVN to fail over to the poisoned infrastructure. After the DVN validated the forged messages, the malicious binary self-destructed and wiped logs, ultimately leading the LayerZero DVN to attest to transactions that never occurred.