Lazarus Group Drains $290M from KelpDAO via LayerZero DVN

Attackers stole roughly 116,500 rsETH (about $290–293M) from KelpDAO by poisoning RPC nodes used by LayerZero's Decentralized Verifier Network, then attempted additional drains that were blocked after Kelp paused contracts. Security firms and outlets attribute the operation to North Korea-linked Lazarus Group; LayerZero and KelpDAO disagree over whether the fault was compromised DVN RPCs or KelpDAO's verifier configuration. The stolen funds were routed through Tornado Cash as part of laundering.

Part of the PlainSec briefing for 2026-04-21

Sources

• The Record from Recorded Future
• TechCrunch Security
• BleepingComputer
• Infosecurity Magazine
• SecurityWeek