-乐乐

Joined the currency circle in 17 years, a senior trader, now participates in OKX's XLayer chain meme, heavy position OKB, configuration of XLayer's community-built meme coins, mainly medium and long-term, it is recommended to hold a position for at least one month!

951Following

2.1Kfollowers

Feed

LayerZero officially releases the complete investigation report on the KelpDAO rsETH cross-chain bridge attack: On April 18, the KelpDAO rsETH bridge, built on the LayerZero cross-chain messaging protocol, was targeted by a state-level hacker attack, resulting in the theft of approximately 116,500 rsETH, valued at about $292 million. Multiple blockchain security agencies traced the attack back to the North Korean hacker group TraderTraitor (UNC4899, a Lazarus Group branch). This attack was not due to a vulnerability in the LayerZero underlying protocol code and did not affect the LayerZero main protocol or any other OApp applications. The risk was entirely concentrated in KelpDAO's own single-validator bridge configuration. This attack was a long-planned advanced supply chain attack, with the entire infiltration cycle starting on March 6: the attacker used social engineering to steal internal developer session keys from LayerZero Labs, successfully infiltrated their RPC cloud server environment, and implanted memory patches to poison and tamper with internal RPC nodes. The tampered nodes returned normal data to internal monitoring systems but pushed forged and altered blockchain state information to the LayerZero DVN decentralized verification network. To completely lock down the attack path, the attacker simultaneously launched a large-scale DoS attack on external third-party RPC service providers, forcing the DVN network to abandon external trusted nodes and rely solely on the compromised internal malicious nodes for on-chain data, ultimately generating legitimate and valid verification proofs for the forged cross-chain messages. KelpDAO, for cost and convenience reasons, used a single-validator 1/1 minimal configuration with no multi-check mechanism in the contract, directly trusting the single validation result, which allowed the attacker to maliciously unlock and transfer a huge amount of rsETH assets. $BTC After the incident, LayerZero Labs immediately initiated security emergency response and architectural rectification: Changed the previous free configuration operation stance, mandating that all DVN access channels must meet minimum multi-security verification configurations, permanently rejecting any project using LayerZero DVN as the sole single-point validation node; fully decommissioned and replaced all contaminated internal RPC nodes, rebuilt internal RPC access permissions and session key management systems; upgraded DVN network failover logic, adding multi-node cross-verification and abnormal data interception mechanisms; mandated all high-value cross-chain asset projects to upgrade to multi-validator, multi-threshold security architectures, prohibiting 1/1 single-point validation modes; opened security self-check tools to remind the entire ecosystem to immediately review their cross-chain verification configurations to prevent similar supply chain attacks; strengthened internal personnel permission grading, social engineering attack prevention, and infrastructure security audits to counter long-term infiltration by state-level hackers. $SOL This incident also serves as a wake-up call for the entire Web3 cross-chain ecosystem: underlying protocol security does not equal application configuration security. Cross-chain asset risks mostly stem from single-point dependencies, operational negligence, and infrastructure supply chain attacks. Multi-validation, multi-source nodes, and permission isolation will become the mandatory security baseline for future cross-chain applications. #KelpDAO: rsETH bridge revival, Solv moves $700 million @OKX中文 @OKX星球