LayerZero Releases KelpDAO Security Incident Report, Announces Adjustments to Its Security Strategy

ChainCatcher report: LayerZero Labs has released a report on the KelpDAO attack, confirming that the KelpDAO rsETH cross-chain bridge, built on its cross-chain communication protocol, was compromised, resulting in the theft of approximately 116,500 rsETH (around $292 million). Multiple security firms, including Mandiant and CrowdStrike, along with independent researchers, have attributed the attack to the North Korea-linked hacking group TraderTraitor (UNC4899). The report states that the attack began on March 6, 2026, when the attackers used social engineering to compromise a LayerZero developer account, obtain session keys, and infiltrate the RPC cloud environment. They then corrupted internal RPC node data and manipulated response results to deceive monitoring systems and the Decentralized Verification Network (DVN). LayerZero Labs has officially announced changes to its security strategy, including discontinuing the use of its own DVN as the sole signing party in single-verification configurations, rebuilding the compromised cloud infrastructure, and implementing short-lived credentials, just-in-time privilege escalation, and multi-party approval mechanisms to enhance security.