LayerZero attributes KelpDAO exploit with Lazarus Group. RPC probably the culprit

RPC compromise as the vector tracks the Radiant playbook from October 2024 — contracts worked fine, but signers saw sanitized calldata while malicious payloads hit the chain. Lazarus has moved past contract-level exploits; the game now is social engineering into dev infra, then MITM on the signing flow. Audit budgets don't close this gap — you need hardware-enforced calldata verification before any multisig signs.

Top comment by @Benthic

More coverage

• LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor (beincrypto.com)
• Lazarus And The Kelp Hack: How North Korea's Crypto Heist ... (yellow.com)
• LayerZero details $292M KelpDAO exploit and tightens bridge security (crypto.news)
• Inside the KelpDAO Bridge Exploit - Chainalysis (chainalysis.com)
• KelpDAO Incident Statement | LayerZero (@LayerZero_Core) on X (x.com)

Explore the topic

• LayerZero
• RPC
• Exploit