LayerZero: Kelp DAO hack
LayerZero: Kelp DAO hack via RPC attack: 1-of-1
LayerZero reported that the incident involving Kelp DAO, valued at approximately $290 million, was not caused by a smart contract error but rather by weaknesses in the protocol’s security architecture. According to the company, Kelp DAO used a single-validator (1-of-1) model despite recommendations to adopt a multi-validator system.
The attack, allegedly linked to the Lazarus Group, affected the infrastructure layer. The attackers gained access to two RPC nodes involved in transaction verification and began manipulating validation data. At the same time, they launched DDoS attacks on other nodes to limit the system’s access to correct data sources.
As a result, the validation system relied only on the compromised nodes, which allowed unauthorized operations involving approximately 116,500 rsETH through the bridge.
LayerZero emphasized that such a scenario was only possible due to the lack of distributed validation. In multi-validator systems, this type of attack is significantly more difficult. It was also noted that other applications in the ecosystem were not affected and that the vulnerability was architectural rather than protocol-level.