- Lazarus Group exploits LayerZero integration to steal $290M from Kelp DAO
- Attackers compromised servers verifying cross‑chain transactions, feeding false data to approve fake transfers
- LayerZero and Kelp DAO dispute blame
The infamous North Korean state-sponsored hacking group, Lazarus, has done it again. It successfully walked away with $290 million in cryptocurrency, after seemingly exploiting a Decentralized Autonomous Organization called Kelp DAO through a solution called LayerZero.
Kelp DAO is an organization that doesn’t have central management, or a CEO. All of the decisions are made collectively by members who hold governance tokens and vote on proposals. It was designed to allow users to earn yield on idle crypto investments.
LayerZero Labs, on the other hand, builds infrastructure that lets different blockchains communicate with each other. It is a vital part of the Web3 ecosystem, since different currencies operate on isolated networks. The DAO used LayerZero as a “messaging layer” between different blockchains.
Shifting blame
Lazarus Group apparently tricked the system by taking control of some of the servers used to verify transactions between blockchains. Then, they made fake transactions look real by feeding false data into the system and forcing it to trust the compromised servers, which allowed them to steal the funds.
After the incident, LayerZero took to X to explain what happened. In an in-depth report which you can read here, it essentially said the attackers exploited Kelp DAO’s setup.
“We have conducted a comprehensive review of active integrations on the LayerZero protocol. We can confirm with confidence that there is zero contagion to any other asset or application,” LayerZero said. “This incident was isolated entirely to KelpDAO's rsETH configuration as a direct consequence of their single-DVN setup.”
Kelp DAO, on the other hand, disagreed with the characterization that the incident was solely the result of its configuration.
While the two organizations shift blame around, Lazarus celebrates another successful heist. The organization has, for years, exploited vulnerable Web3 projects, bridges and DAOs, to steal funds and finance North Korea’s state apparatus and weapons programs.
Via TechCrunch
