# LayerZero RPC-Poisoning Attack

*LayerZero attributed the KelpDAO exploit to an RPC-poisoning attack by the TraderTraitor subgroup of North Korea's Lazarus Group.*

By [ETH Daily](https://ethdaily.io) · 2026-04-20

news, 2026, april2026, layerzero, kelpdao, exploit, lazarus, dprk, rpc, dvn, security

---

LayerZero [published](https://x.com/LayerZero_Core/status/2046081551574983137) a statement claiming the exploit stemmed from a sophisticated RPC-poisoning attack that manipulated its DVN's verification process. It attributed the attack to the TraderTraitor subgroup of North Korea's Lazarus Group. According to LayerZero, the attackers compromised RPC nodes and fed forged data directly to the DVN while masking activity from monitoring systems.

LayerZero Labs placed responsibility on KelpDAO, arguing its 1-of-1 DVN configuration enabled the exploit, even though LayerZero's own DVN was the sole verifier KelpDAO relied on. LayerZero stated that it will no longer support single-DVN setups. The company also did not outline any intentions to compensate impacted users.

* * *

Sponsored by
------------

[![Lido Earn](https://storage.googleapis.com/papyrus_images/81f33d00a6b2ca439a0c600e476f7ed085d865617c3c00a46875ed73b4c50710.jpg)](https://stake.lido.fi/earn)

Lido Earn lets you deploy ETH or stablecoins into curated DeFi strategies for optimised yield. Two vaults, daily rewards, automatic compounding, and first-loss protection. Get started on [stake.lido.fi/earn](https://stake.lido.fi/earn)

Notice - April 20, 2026: [**EarnETH has direct exposure to rsETH**](https://x.com/LidoFinance/status/2046250840961216965).

* * *

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

---

*Originally published on [ETH Daily](https://ethdaily.io/layerzero-rpc-poisoning-attack)*