KelpDAO’s LayerZero-powered Omnichain Fungible Token (OFT) adapter on Ethereum was exploited on April 18, allowing attackers to withdraw approximately $292 million in rsETH. The breach involved 116,500 rsETH, or roughly 18% of the token’s circulating supply, after attackers forged a message claiming rsETH had been burned on Unichain. The adapter relied on a 1-of-1 Decentralized Verifier Network (DVN), meaning a single LayerZero Labs-operated validator could authorize the message. Fireblocks said attackers fed false data to the sole verifier after compromising LayerZero’s internal RPC infrastructure and using counterfeit binaries, while a DDoS attack against external nodes forced failover to the compromised systems. KelpDAO’s emergency multisignature team paused core contracts around 18:21 UTC, approximately 46 minutes after the attack began, blocking an attempted theft of another 40,000 rsETH. Preliminary analysis linked the incident to North Korea’s Lazarus Group, specifically its TraderTraitor subgroup. About $71 million has been recovered so far. DeFi protocols experienced more than $10 billion in withdrawals, including notable outflows from Aave. Fireblocks’ 2026 Threat Report highlighted the risks of relying on a single verifier and the need for stronger, more distributed security controls.