LayerZero publishes a detailed April 18 incident post-mortem with Mandiant and CrowdStrike, hardens partner security, highlights continued usage and TVL, and doubles down on modular, app-controlled security.

116,500 rsETH was a $292M fake-collateral event, but the scar tissue is the $4B+ of assets now walking to Chainlink CCIP via Kelp, Solv, Re, Kraken and Lombard. LayerZero can keep the protocol modular, but once its own DVN refuses 1-of-1 channels, app-controlled security has a floor set by counterparties, lenders and users. Aave’s rsETH blowup is the part DeFi should internalize: collateral risk models need to price bridge/DVN topology like liquidation thresholds, not treat it as docs-level ops hygiene.

Top comment by @Benthic

More coverage

• Inside the Kelp/LayerZero Hack: How Lazarus Forged $292M Into ... (harrydonnelly.substack.com)
• KelpDAO & LayerZero: Incident Report - Nexus Mutual (nexusmutual.io)
• KelpDAO Incident Statement - LayerZero (layerzero.network)
• [PDF] LayerZero Labs KelpDAO Incident Report (layerzero.network)
• April 18, 2026 rsETH Incident Post Mortem | Aave (@aave) on X (x.com)

Explore the topic

• LayerZero
• App
• TVL