Lazarus Group linked to biggest DeFi exploit of 2026

Traders Union
All News
Crypto
Lazarus Group linked to DeFi exploit

Highlights

LayerZero attributes the $292 million Kelp DAO hack to North Korea’s Lazarus Group.
The attack exploited a single-verifier (1-of-1) setup on the bridge.
DeFi TVL fell by more than $13 billion in two days following the exploit.

How the attack unfolded

According to LayerZero, the hackers compromised the list of RPC nodes used by its decentralized verifier network (DVN). They compromised two nodes to broadcast a forged cross-chain message, while simultaneously launching a DDoS attack on legitimate nodes. This forced the system to rely on the compromised ones, allowing the fake message to pass verification and trigger an unauthorized token unlock on the bridge.

LayerZero emphasized that the breach succeeded largely because Kelp DAO relied on a single-verifier setup (1-of-1 configuration) without any backup. This created a single point of failure with no independent check to reject the fraudulent message. The company noted it had previously warned Kelp DAO about the risks of such a setup and recommended diversifying its DVN configuration.

“Using a single point of failure meant there was no independent verifier to detect and reject fake messages,” LayerZero stated. The firm has now announced it will no longer sign messages for any applications using the vulnerable 1/1 DVN setup.

Ripple effects across DeFi

The exploit triggered a sharp decline in the broader decentralized finance sector. Total value locked (TVL) in DeFi protocols dropped more than $13 billion over two days, falling from $99.5 billion to $86.3 billion. The attacker transferred the stolen rsETH to Aave V3, using it as collateral to borrow large amounts of WETH. This raised concerns about potential bad debt, prompting Aave to freeze rsETH markets on both V3 and V4 versions.

The incident has heightened tensions across the DeFi ecosystem and underscored ongoing vulnerabilities in cross-chain bridges, even as the core LayerZero infrastructure itself was not directly breached.

Persistent risks in cross-chain infrastructure

The Kelp DAO incident serves as a stark reminder of the dangers posed by insufficient security measures in interoperability protocols.

While multi-verifier systems remained unaffected, the reliance on a lone verifier created an exploitable weakness.

As DeFi continues to grow, such events highlight the need for stricter standards in bridge configurations and the importance of heeding prior security recommendations to protect user funds.

Earlier, we reported about the impact on Aave and systemic risks for DeFi.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.