Summary
Ketju does not approve LayerZero as a dependency: on 2026-04-18 attackers compromised LayerZero Labs' own verifier infrastructure and stole about $292M from a bridge that trusted only LayerZero Labs' verifier. The attackers took over two internal nodes on separate clusters and forged attestation data. They stole 116,500 rsETH from Kelp DAO's OFT bridge, which used a 1-of-1 setup. No smart-contract bug was involved. LayerZero is a messaging layer on which other protocols build bridges and omnichain tokens. Each integration chooses which Decentralized Verifier Network (DVN) operators must attest to a message, from one DVN up to a larger set. The incident proved that LayerZero Labs' own infrastructure is a single point of failure, already exploited, for any integration that adds no independent verifier. A large share of real deployments use no independent verifier.
Review triggers
- An integration that Ketju would otherwise approve uses at least a 2-of-2 DVN setup whose operators share no infrastructure, verified on-chain and not from documentation
- LayerZero Labs publishes an independent security audit, after the incident, of its own DVN and RPC infrastructure and not only its smart contracts, with remediation confirmed
- Twelve months pass from 2026-04-18 with no second compromise of LayerZero Labs infrastructure
- Message Library upgrade authority is fully disclosed and mapped to a named, accountable party
Facts
- Verdict
- Not approved
- Type
- Other
- Chains examined
- Ethereum
- Reviewed
- Last confirmed