LayerZero has attributed the $290 million Kelp DAO exploit to North Korea's Lazarus Group and its TraderTraitor subunit, who compromised two of the remote procedure call (RPC) nodes that LayerZero's verifier relied on to confirm cross-chain transactions. The attackers swapped the binary software running on two of these nodes with malicious versions designed to tell LayerZero its verifier that a fraudulent transaction had occurred, while simultaneously reporting accurate data to every other system querying these same nodes. The attack only worked because Kelp ran a 1-of-1 verifier configuration, which LayerZero had previously warned against. The company has confirmed no contagion to any other application on the protocol.