LayerZero released a report on the KelpDAO attack, alleging that a North Korean hacking group was behind it.

CoinFeed reported on May 20th that LayerZero released an incident report stating that on April 18th, 2026, the KelpDAO rsETH cross-chain bridge built on LayerZero was attacked, resulting in the loss of approximately 116,500 rsETH, worth about $292 million. Mandiant and CrowdStrike attributed the attack to the North Korean hacking group TraderTraitor (UNC4899). The attackers, starting in March, obtained developer session keys through social engineering, compromised the LayerZero RPC cloud environment, and tampered with RPC node data. Simultaneously, they launched a DoS attack on external RPC services, inducing DVN to rely solely on the signatures of the corrupted nodes, thereby forging cross-chain messages.