LayerZero Announces KelpDAO Security Incident Report: Will Adjust Security Policies and Rebuild Affected Cloud Infrastructure

Deep Tide TechFlow News — On May 20, LayerZero Labs released a report on the KelpDAO attack incident, confirming that the KelpDAO rsETH cross-chain bridge built on its cross-chain communication protocol was attacked, with approximately 116,500 rsETH (about $292 million) stolen. Multiple security organizations, including Mandiant and CrowdStrike, as well as independent researchers, attributed the attack to the North Korea-linked hacking group TraderTraitor (UNC4899). The report indicates that the attack began on March 6, 2026. The attackers used social engineering to compromise LayerZero developer accounts, obtain session keys, and infiltrate the RPC cloud environment, further contaminating data on internal RPC nodes, and manipulating return results to deceive monitoring systems and decentralized verification networks (DVN).

LayerZero Labs formally announced that it will adjust its security strategy, including no longer allowing its own DVN to act as the sole signer in a single validation configuration. It will rebuild the affected cloud infrastructure and introduce short-term credentials, immediate permission upgrades, and a multi-party approval mechanism to strengthen security.