Kelp Reports Nearly $290 Million Crypto Theft; LayerZero Cites Single-Verifier Setup
Summary
Kelp confirmed a crypto theft reported at nearly $290 million. LayerZero attributed it preliminarily to TraderTraitor and blamed Kelp’s single-verifier setup; a Kelp source disputed that account. LayerZero and Aave are assessing responses.
Key points
- Kelp confirmed an incident and paused activity after security firms reported nearly $290 million in cryptocurrency leaving the platform.
- LayerZero said preliminary indicators point to TraderTraitor, linked to North Korea’s Lazarus operation; the attribution is not independently confirmed in the article.
- According to LayerZero’s post-mortem, attackers forged rsETH without real Ether collateral and used it to borrow assets on other platforms.
- LayerZero blamed Kelp’s single Decentralized Verifier Network (DVN) configuration. A Kelp source disputed that account, saying the post-mortem implicated LayerZero server compromise and that Kelp had not been warned about the configuration.
- LayerZero said attackers used a DDoS attack against backup systems and self-destructing tools, and that their tactics evaded security monitoring.
- LayerZero said it will no longer approve applications using a single verifier. Aave is assessing possible resolutions, and law enforcement is involved.
Article Details
- Victim Organization
- Kelp
- Incident Type
- Cryptocurrency theft involving forged rsETH minted through a compromised verification setup and used as collateral to borrow real assets.
- Operational Impact
- Nearly $290 million in cryptocurrency was reported stolen. Kelp paused activity during the investigation. Aave said it was assessing potential resolutions, and thousands of users reportedly tried to withdraw funds, with some unable to do so.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Vendors
Products
AaveLayerZero blamed Kelp’s single-DVN configuration, said it will block single-verifier integrations, and affected platforms like Aave and law enforcement are involved in assessing responses.Kelphackers known as TraderTraitor (part of the Lazarus operation) exploited a single-verifier setup tied to Kelp and LayerZero, minting fake rsETH and using it as collateral to drain funds.LayerZeroas TraderTraitor (part of the Lazarus operation) exploited a single-verifier setup tied to Kelp and LayerZero, minting fake rsETH and using it as collateral to drain funds.rsETHof the Lazarus operation) exploited a single-verifier setup tied to Kelp and LayerZero, minting fake rsETH and using it as collateral to drain funds.