Slow Fog's Cosine Breakdown of the KelpDAO Attack Process

Mars Finance reports that, according to an analysis by SlowMist founder Yu Xian (@evilcos), the core of the approximately $290 million theft incident involving KelpDAO was a targeted poisoning attack on the downstream RPC infrastructure of LayerZero DVN (Decentralized Validator Network). The specific attack steps were as follows: first, obtain the list of RPC nodes used by LayerZero DVN; then breach two independent clusters and replace the op-geth binary. Using selective deception techniques, the attacker returned a forged malicious payload only to the DVN, while returning real data to other IP addresses. At the same time, the attacker launched DDoS attacks on the RPC nodes that had not been breached, forcing the DVN to fail over to the already poisoned nodes. After completing forged message verification, the malicious binary self-destructed and cleared the logs. Ultimately, this led LayerZero DVN to issue validation for “transactions that never occurred.”