$292 million, and that one transaction is gone.
North Korea’s Lazarus changed two of Kelp DAO’s validator nodes. It DDoS’d the rest, so the system could only trust the controlled “insider” — forged messages went straight through, and 116,500 rsETH was unlocked and transferred out.
Not a code vulnerability, not a key leak. The issue came from a “convenience” configuration choice: 1/1 DVN single-node validation. LayerZero suggested switching to multi-node, but nobody listened.
#Web3安全 #LayerZero #跨链桥安全 #Lazarus #DeFi security
North Korea’s Lazarus changed two of Kelp DAO’s validator nodes. It DDoS’d the rest, so the system could only trust the controlled “insider” — forged messages went straight through, and 116,500 rsETH was unlocked and transferred out.
Not a code vulnerability, not a key leak. The issue came from a “convenience” configuration choice: 1/1 DVN single-node validation. LayerZero suggested switching to multi-node, but nobody listened.
#Web3安全 #LayerZero #跨链桥安全 #Lazarus #DeFi security