Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea’s Lazarus Group: LayerZero

The total value locked on decentralized lending platform Aave is plunging after hackers exploited KelpDAO’s cross-chain rsETH configuration, with LayerZero saying preliminary indicators point to North Korea’s Lazarus Group.

LayerZero says KelpDAO was exploited for about $290 million on April 18 and describes the attacker as a “highly-sophisticated state actor,” likely tied to Lazarus Group and its TraderTraitor unit.

In a statement, LayerZero says the incident was limited to KelpDAO’s rsETH setup and did not spread to other assets or applications using the protocol.

According to blockchain tracker LookonChain, the exploit led to roughly $292 million worth of rsETH being minted illegitimately. The attacker then used the token as collateral to borrow more than 82,600 Ether (ETH), worth about $195 million, from Aave.

LookonChain says the bad debt triggered large withdrawals from Aave, causing its TVL to fall by $6.28 billion in less than 48 hours, from $26.396 billion to $20.114 billion.

It says major withdrawals include $431 million from MEXC, $405.7 million from wallet 0x7CD0, possibly linked to Nonco, and $392 million from Abraxas Capital.

LayerZero says the attack targeted downstream RPC infrastructure used by its Decentralized Verifier Network rather than exploiting the LayerZero protocol itself, adding that compromised nodes had been replaced and the verifier network was back online.

Aave moved to freeze rsETH markets on V3 and V4 to prevent additional borrowing and deposits while it evaluates options to cover any deficit.

Generated Image: Midjourney