Executive Summary

The $2.1M exploit involving LayerZero occurred on April 18, 2026, as part of a broader series of attacks (including a $292M exploit of KelpDAO) attributed to the Lazarus Group. The incident was not a failure of the LayerZero protocol's core code, but rather a compromise of the off-chain infrastructure combined with a weak security configuration on the application side.

Executive Summary

The exploit was executed by compromising LayerZero Labs' internal RPC infrastructure via social engineering. This allowed attackers to feed forged data to a Decentralized Verifier Network (DVN). Because the targeted application, Thetanuts Finance, was allegedly using a 1-of-1 DVN configuration, the single compromised signature was sufficient to authorize the release of $2.1M in assets on Ethereum.

Technical Mechanics of the Exploit

The attack followed a sophisticated path from infrastructure poisoning to cross-chain execution:

1. Infrastructure Compromise: Attackers gained access to internal RPC nodes. They injected malicious code (ELF PIE) into memory to return forged block data [Source: https://cybernews.com/crypto/300m-stolen-in-cross-chain-bridge-hack-largest-defi-exploit-of-2026/].
2. Forged Messaging: The attacker initiated a request claiming tokens were burned on a source chain (Unichain). The compromised RPC nodes provided the DVN with fake confirmation of this burn.
3. Verification Failure: The LayerZero DVN, relying on the poisoned RPC data, produced a valid ECDSA attestation.
4. Execution: This attestation was submitted to the destination chain (Ethereum). The ReceiveUln302.verify() function accepted the proof as cryptographically valid, triggering the release of $2.1M from the bridge escrow.

Chains Involved and Asset Flow

The exploit spanned multiple networks to fabricate and then extract value:

The Role of DVN Configuration

A critical factor in the success of the exploit was the 1-of-1 DVN configuration. In LayerZero's architecture, applications can choose multiple verifiers (e.g., requiring signatures from both LayerZero Labs and a third party like Google Cloud or Polyhedra).

• The Vulnerability: By using a 1-of-1 setup, Thetanuts Finance had no secondary independent verifier to catch the forged data from the compromised LayerZero Labs node.
• Contested Detail: While it is confirmed that a 1-of-1 configuration allowed the KelpDAO exploit to reach $292M, the specific DVN configuration for Thetanuts Finance at the time of the $2.1M loss is noted as unverifiable in some incident reports [Note: not independently confirmed]. Some analysts suggest the protocol may have recently moved from a multi-verifier to a single-verifier setup prior to the attack, though this remains unconfirmed [Note: not independently confirmed].

Summary of Components

The exploit highlights the "weakest link" risk in cross-chain messaging: even if the protocol is secure, the off-chain infrastructure and the specific security parameters (DVN counts) chosen by individual applications can create critical points of failure.