Phân tích của SlowMist tiết lộ phương pháp tấn công của KelpDAO liên quan đến LayerZero DVN

The Huoxing Finance report, according to analysis by Yu Xian (@evilcos), founder of SlowMist, the core of the $290 million theft incident involving KelpDAO was a targeted poisoning attack on the downstream RPC infrastructure of LayerZero DVN (Decentralized Verifier Network). The specific attack steps were as follows: First, obtain the list of RPC nodes used by LayerZero DVN, then compromise two independent clusters and replace the op-geth binary files; using selective deception techniques, return only forged malicious payloads to the DVN while providing legitimate data to other IPs; simultaneously launch DDoS attacks on uncompromised RPC nodes to force DVN failover to the poisoned nodes, after which the malicious binary self-destructs and clears logs following the verification of forged messages. This ultimately caused LayerZero DVN to issue verification for transactions that never occurred.