ME News reports that on April 18, 2026, the KelpDAO rsETH cross-chain bridge was attacked, with approximately 116,500 rsETH (about $292 million) stolen, pointing to North Korean-linked hackers associated with TraderTraitor (UNC4899). The attack began on March 6, with hackers infiltrating developer accounts through social engineering and penetrating RPC cloud services, forging cross-chain proofs, and using external RPC DDoS attacks to facilitate fund extraction. The core issue was that a single validator configuration allowed assets to be released with just one signature. LayerZero will adjust its strategy by disabling the sole signature requirement for DVN in single-signature scenarios, rebuilding cloud infrastructure, adding short-term credentials and multi-party approvals to enhance cross-chain security.

MeNews

2026-05-20 15:40:18

Abstract generation in progress

ME News Report, May 20 (UTC+8), LayerZero Labs released the latest incident report stating that on April 18, 2026, the KelpDAO rsETH cross-chain bridge built on its cross-chain communication protocol was attacked, resulting in approximately 116,500 rsETH (about $292 million) being stolen. Several security agencies including Mandiant, CrowdStrike, and independent researchers attributed the attack to North Korea-linked hacker group TraderTraitor (UNC4899). The report shows that the attack began on March 6, 2026, when the attacker used social engineering to compromise a LayerZero developer account, obtain session keys, and infiltrate the RPC cloud environment, further contaminating internal RPC node data and manipulating return results to deceive monitoring systems and decentralized verification networks (DVN). Subsequently, the attacker launched a denial-of-service attack against external RPC providers, causing the verification system to rely on compromised nodes to generate fake cross-chain proofs, thereby successfully extracting funds. LayerZero pointed out that the core vulnerability in this incident was due to the affected application adopting a "single-verifier" configuration, which allowed the target contract to execute asset release upon receiving a single valid signature, leading to rsETH being stolen. After the incident, LayerZero Labs announced plans to adjust security policies, including no longer allowing their own DVN to serve as the sole signer in single-verifier configurations, rebuilding the affected cloud infrastructure, and introducing short-term credentials, instant permission upgrades, and multi-party approval mechanisms to enhance security. Additionally, zeroShadow and law enforcement agencies have intervened in the investigation and asset tracking. LayerZero stated it will continue to work with ecosystem partners to strengthen cross-chain security systems to address increasingly sophisticated nation-state level attack threats. (Source: ODaily)

ZRO1.56%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

7 Likes

Reward
7
10
13
Share

Comment

Add a comment

GateUser-170ee8b1

· 11h ago

Developer accounts are targeted by social engineering; classic vulnerabilities never go out of style.

View OriginalReply0

OldBlackVelvetKey

· 23h ago

Cross-chain bridges are just hacker ATMs; how many more times do I need to say this?

View OriginalReply0

MintCondition

· 23h ago

UNC4899 that code sounds like a stock, but it turns out to be North Korea's national team

View OriginalReply0

RationalRugChecker

· 23h ago

Short-term certificates + multi-party approval should have been in place already; now it's called reconstruction.

View OriginalReply0

ColdWalletUnderTheAurora

· 23h ago

RPC cloud surrenders the keys obediently when DDoS attacks, cloud-native remains lonely in silence

View OriginalReply0

RouterWhisperer

· 23h ago

The design where DVN is the sole signer has surprisingly lasted until 2026

View OriginalReply0

MistBlueLily

· 23h ago

It started infiltrating on March 6th, and only discovered it on April 18th. Is this surveillance just a show?

View OriginalReply0

NarrativeCartographer

· 23h ago

North Korean hackers are better at social engineering than DeFi.

View OriginalReply0

TvlAt3A.m.

· 23h ago

LayerZero's attempt to mend the sheep pen, but the sheep are already gone.

View OriginalReply0

MetalRoboticArm

· 23h ago

Only one signature is needed to release 290 million, is this configuration serious?

View OriginalReply0

Trending Topics
View More
#
TradfiTradingChallenge
227.78K Popularity
#
GrayscaleBuysAndStakesOver510KHYPE
8.91M Popularity
#
DailyPolymarketHotspot
1.01M Popularity
#
SpaceXOfficiallyFilesforIPO
748.48K Popularity
#
GateSquarePizzaDay
1.71M Popularity

Pinned

Sitemap

LayerZero releases KelpDAO attack incident report: North Korean hacker group accused of involvement and will adjust security strategies

Trending Topics

TradfiTradingChallenge

GrayscaleBuysAndStakesOver510KHYPE

DailyPolymarketHotspot

SpaceXOfficiallyFilesforIPO

GateSquarePizzaDay

Pinned