LayerZero attributes an April 18 exploit that drained 116,500 rsETH (~$292M) from Kelp DAO to DPRK-linked Lazarus Group actor ‘TraderTraitor’. The attacker poisoned RPC nodes used by LayerZero’s decentralized verifier network (DVN), DDoSed clean nodes so the DVN relied on poisoned nodes, and submitted a forged cross‑chain message. Kelp DAO’s single 1-of-1 DVN had no backup verifier. The attacker moved stolen rsETH into Aave V3 as collateral, borrowed large amounts of WETH, prompting Aave to freeze rsETH markets and triggering >$10B in Aave outflows. Several protocols paused LayerZero OFT bridges and DeFi TVL fell ~7% to $86.3B. LayerZero says multi-DVN apps have “zero contagion,” will stop signing 1/1 DVN messages, and law enforcement tracing continues.

Facts from the summary: 116,500 rsETH (~$292M) was stolen from Kelp DAO; LayerZero says DPRK-linked Lazarus actor ‘TraderTraitor’ poisoned RPC nodes and DDoSed clean nodes to force the DVN to accept a forged cross‑chain message; Kelp DAO used a single 1-of-1 DVN with no backup; attacker moved stolen rsETH to Aave V3 and borrowed WETH leading Aave to freeze rsETH markets and >$10B outflows; multiple protocols paused LayerZero OFT bridges and DeFi TVL fell ~7% to $86.3B; LayerZero says multi-DVN setups are not affected and will stop signing 1/1 DVNs.