LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group

The exploit that drained roughly $292 million from KelpDAO’s cross-chain bridge over the weekend was “likely” the work of North Korea’s Lazarus Group, specifically its TraderTraitor subunit, LayerZero said in a preliminary analysis on Monday.

Attackers drained 116,500 rsETH, a liquid restaking token backed by staked ether, from the KelpDAO bridge on Saturday, setting off withdrawals across the decentralized finance sector that pulled more than $10 billion out of lending protocol Aave .

The attack carried the markings of “a highly-sophisticated state actor, likely DPRK’s Lazarus Group,” LayerZero said, specifying the group’s TraderTraitor subunit.

North Korea’s cyber operations run under the Reconnaissance General Bureau, which houses several distinct units, including TraderTraitor, AppleJeus, APT38, and DangerousPassword, according to an analysis by Paradigm researcher Samczsun.

Among these subunits, TraderTraitor has been flagged as the most sophisticated DPRK actor targeting crypto, previously linked to the Axie Infinity Ronin Bridge and WazirX compromises.

LayerZero said that KelpDAO had used a single verifier to approve transfers in and out of the bridge, adding that it had repeatedly urged KelpDAO to use multiple verifiers instead.

Going forward, LayerZero said it will stop approving messages for any application still running that setup.

Observers say the exploit exposed how the bridge was built to trust a single verifier.

It was “a single point of failure, regardless of what the marketing calls it,” Shalev Keren, co-founder at cryptographic security firm Sodot, told Decrypt .

A single compromised checkpoint was enough to allow the funds to leave the bridge, and no audit or security review could have fixed that flaw without “removing unilateral trust from the architecture itself,” Keren said.

That view was echoed by Haoze Qiu, Blockchain Lead at Grvt, who argued that, "Kelp DAO appears to have accepted a bridge security setup with too little redundancy for an asset of this scale," adding that LayerZero "also has accountability" given that "the compromise involved infrastructure tied to its validator stack, even if this was not described as a core protocol bug."

The attackers came within three minutes of draining another $100 million before a rapid blacklist cut them off, according to an analysis by blockchain security firm Cyvers. The operation was based on tricking a single channel of communication, Cyvers CTO Meir Dolev told Decrypt .

Attackers tapped two of the lines the verifier used to check whether a withdrawal had actually occurred on Unichain, fed it a fake “yes” on those lines, then knocked the remaining lines offline to force the verifier to rely on the compromised ones.

“The vault was fine. The guard was honest. The door mechanism worked correctly,” Dolev said. “The lie was whispered directly to the one party whose word opened the door.”

But while LayerZero, whose infrastructure powered the drained bridge, pointed to Lazarus as the likely culprit, Cyvers stopped short of the same attribution in its own analysis.

Some patterns match DPRK-linked operations in sophistication, scale, and coordinated execution, Dolev said, but no wallet clustering tied to the group has been confirmed.

The malicious node software was engineered to erase itself once the attack finished, wiping binaries and logs to obscure the attackers’ trail in real time and in the post-mortem, he added.

Earlier this month, attackers drained roughly $285 million from Solana -based perpetuals protocol Drift, in an exploit later attributed to North Korean operatives.

Dolev noted that the Drift hack was “very different in terms of the preparations and execution,” but both attacks required long lead times, deep expertise, and significant resources to pull off.

Cyvers suspects that the stolen funds have been transferred to this Ethereum address , aligning with a separate report from on-chain investigator ZachXBT which flagged it alongside four others. The attack addresses were funded through coin mixer Tornado Cash, per ZachXBT.

Strategy reported its largest Bitcoin purchase in over 16 months on Monday, scooping up $2.54 billion worth of BTC last week as traders snapped up its flagship preferred to receive an upcoming dividend. The Tysons Corner, Virginia-based firm said that it purchased roughly 34,200 Bitcoin, lifting its stockpile to a total of around 815,000 Bitcoin. With Bitcoin trading close to $75,400, the sum was valued at around $61.4 billion, according to CoinGecko. The Bitcoin-buying firm announced that...

3,478.5543 Morning Minute is a daily written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt. And check out our new daily news show covering all of the top stories in 5 minutes or less, downloadable on Apple Pod or Spotify. GM! Today’s top news: Crypto majors fall then rebound as Iran tensions escalate; BTC at $75.4k ETFs see $1.4B in inflows on the week, 2nd biggest week of year DeFi TVL falls by $13B as KelpDAO exploi...

This website or its third-party tools use cookies. By clicking the accept button, you agree to the use of cookies.