Country visual unavailable
No information
LayerZero RPC compromise enables $292 million KelpDAO bridge theft
The breach began on 6 March 2026 when an attacker socially engineered a LayerZero Labs developer, harvested session keys, entered LayerZero's RPC cloud and poisoned internal RPC nodes. On 18 April the attacker combined tampered RPC responses with a denial-of-service attack against an external RPC provider, causing the LayerZero Labs DVN to attest forged state used by KelpDAO's rsETH bridge and resulting in the loss of about USD 292 million; LayerZero reported attribution to DPRK-linked TraderTraitor/UNC4899.
94
Estimated severity
94 / 100
95
Source reliability
95 / 100
Approximate Date
2026-03-06
Targeted Company
LAYERZERO LABS
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
KELP DAO (Digital platform provider)
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
No information
Affected countries
No information
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
$292M
Impact types
Downstream customer disruptionOperational disruptionService unavailabilitySupply chain data integrity impact
Affected sectors
Finance & InsuranceTechnology & IT Services
Affected departments
Engineering & MaintenanceInformation Technology
Attack Profile
Attack types
Data modificationDenial of serviceSocial engineeringUnauthorized accessUse of stolen credentials
Attributed threat actors
TRADERTRAITORUNC4899