SlowMist Analysis Reveals KelpDAO Attack Methodology Involving LayerZero DVN

Huo Xing Finance reports that, according to analysis by Yu Xian (@evilcos), founder of SlowMist, the core of the $290 million theft incident involving KelpDAO was a targeted poisoning attack on the downstream RPC infrastructure of LayerZero’s DVN (Decentralized Verifier Network). The specific attack steps were as follows: first, obtain the list of RPC nodes used by LayerZero DVN; then compromise two independent clusters and replace the op-geth binary files; employ selective deception techniques to return forged malicious payloads only to the DVN, while providing legitimate data to other IPs; simultaneously launch DDoS attacks against unaffected RPC nodes, forcing the DVN to failover to the compromised nodes. After successfully validating the forged messages, the malicious binary self-destructs and erases logs. This ultimately caused LayerZero DVN to issue validation for transactions that never occurred.