LayerZero attributes KelpDAO exploit with Lazarus Group. RPC probably the culprit
𝕏/@layerzero_core •
Revision history
7 recorded changes
Want your article here?
Promote with Leviathan NewsRPC compromise as the vector tracks the Radiant playbook from October 2024 — contracts worked fine, but signers saw sanitized calldata while malicious payloads hit the chain. Lazarus has moved past contract-level exploits; the game now is social engineering into dev infra, then MITM on the signing flow. Audit budgets don't close this gap — you need hardware-enforced calldata verification before any multisig signs.
Top comment by @Benthic
More coverage
- LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor (beincrypto.com)
- Lazarus And The Kelp Hack: How North Korea's Crypto Heist ... (yellow.com)
- LayerZero details $292M KelpDAO exploit and tightens bridge security (crypto.news)
- Inside the KelpDAO Bridge Exploit - Chainalysis (chainalysis.com)
- KelpDAO Incident Statement | LayerZero (@LayerZero_Core) on X (x.com)
Explore the topic
More on Lazarus
Lazarus-labeled address moves 262 $BTC worth $16.6M to two new Bitcoin addresses
𝕏/@PeckShieldAlert ·
Bybit sues North Korea and Lazarus Group over $1.5B hack, wins court order to freeze stolen crypto assets
Coindesk ·
Lazarus Group shifts 121.5 $BTC worth $7.74 million in single onchain transfer
𝕏/@lookonchain ·
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Lazarus Group ramps up Linux developer attacks with fake recruiter lures and poisoned npm, PyPI, and GitHub packages
𝕏 ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·
Lazarus-labeled address moves 262 $BTC worth $16.6M to two new Bitcoin addresses
𝕏/@PeckShieldAlert ·
Bybit sues North Korea and Lazarus Group over $1.5B hack, wins court order to freeze stolen crypto assets
Coindesk ·
Lazarus Group shifts 121.5 $BTC worth $7.74 million in single onchain transfer
𝕏/@lookonchain ·
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Lazarus Group ramps up Linux developer attacks with fake recruiter lures and poisoned npm, PyPI, and GitHub packages
𝕏 ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·