$292M gone. In 24 hours. Here's how North Korea just shook the entire DeFi ecosystem, and why LayerZero, KelpDAO, and Aave all share the blame. 🧵
On April 18, attackers drained 116,500 rsETH (~$292M) from KelpDAO's cross-chain bridge, built on LayerZero infrastructure. Unbacked rsETH tokens were minted through a misconfigured LayerZero cross-chain bridge, creating fake liquidity that triggered a massive crunch across DeFi.
The attack carried markings of a "highly sophisticated state actor", LayerZero pointed to North Korea's Lazarus Group, specifically the TraderTraitor subunit, previously linked to the Axie Infinity Ronin Bridge and WazirX hacks. Pattern? Very much so.
The root flaw: KelpDAO ran rsETH with a 1-of-1 DVN setup, LayerZero Labs as the sole verifier, directly contradicting the multi-DVN redundancy model LayerZero had consistently recommended. One compromised node. $292M gone. KelpDAO counters that the 1/1 setup was LayerZero's own GitHub default, currently used by ~40% of protocols. The blame game is real.
Aave froze rsETH markets on V3 and V4, and saw $10B in outflows — its total supply dropping from $45.8B to $35.7B. Total DeFi TVL tanked to $85.6B in 24 hours.
The message is clear: interconnected DeFi is only as strong as its weakest single point of failure.