The process of the KelpDAO attack analyzed by Slow Fog
Prefer us on Google
According to SlowMist founder Yu Xian (@evilcos), the core of the KelpDAO theft incident, which involved approximately $290 million, was a targeted poisoning attack on the downstream RPC infrastructure of LayerZero DVN (Decentralized Validator Network).
The specific attack steps were: first, obtaining the list of RPC nodes used by LayerZero DVN, then breaching two independent clusters and replacing the op-geth binary file; using selective deception techniques to return forged malicious payloads only to DVN while returning real data to other IPs; simultaneously launching DDoS attacks on the unbreached RPC nodes, forcing DVN to failover to the poisoned nodes, completing the forged message verification, and then the malicious binary self-destructing and clearing logs. This ultimately led to LayerZero DVN issuing validations for "transactions that never occurred."
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
FTX/Alameda Wallet Transfers Over $8 Million in ZRO Tokens to Wintermute
Key Takeaways An FTX/Alameda-associated wallet moved 4.126 million ZRO tokens to market maker Wintermute, with an approximate value…
North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…
DeFi Losses Top $600 Million Amid Kelp DAO Exploit and TVL Decline
Key Takeaways: Total DeFi losses have skyrocketed to approximately $1 billion recently, with $600M+ linked directly to the…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Why is a16z Crypto raising another $2.2 billion to heavily invest in Web3?
LayerZero CEO counters KelpDAO: rsETH initially used the default configuration, then manually switched to the not recommended 1/1 configuration
Kelp DAO abandoned LayerZero after the attack incident and switched to Chainlink's cross-chain infrastructure
Analyst: The attacker of the Wasabi protocol has transferred all stolen funds to Tornado Cash
The billion-dollar lesson: The focus of DeFi security is shifting from code to operational governance
Blockchain trading platform Ekiden has completed a $2 million seed round financing, with participation from Unicorn Factory Ventures and others
Morning Report | Visa includes Polygon in its global stablecoin settlement program; MoonPay invests $100 million to acquire security company Sodot; Digital wallet platform Belo completes $14 million Series A financing
KelpDAO injects 2000 ETH into the DeFi United Recovery Fund to advance the rsETH recovery plan
DeFi United announced the technical solution for the Kelp rsETH vulnerability, planning to liquidate approximately 107,000 tokens from the attacker’s position
LayerZero promises to provide DeFi United with over 10,000 ETH, including a donation of 5,000 ETH
How to balance risk and return in DeFi yields?
Lido proposes to use up to $5.8 million in stETH to fill the funding gap for Kelp
North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…
The attacker of KelpDAO transferred part of the stolen funds across chains to Arbitrum, exchanged them for USDT, and flowed into the Tron ecosystem
Ethena has restored the LayerZero cross-chain bridge functionality for sUSDe and USDe and strengthened security configurations
Arbitrum freezes $71M of ETH linked to Kelp exploit
Key Takeaways: Arbitrum’s security council froze 30,766 ETH connected to a major Kelp exploit, valued at $71.2 million.…
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
A $293 Million Hack Cuts Deep into Aave’s $8 Billion TVL: Is DeFi Staring at a Crisis?
Key Takeaways: Aave’s total value locked (TVL) plunged from $26.4 billion to $17.94 billion following a massive hack.…
Kelp DAO: The reason for the theft is that LayerZero's RPC node was compromised
Morning News | The Hong Kong Securities and Futures Commission announced the regulatory framework for secondary market trading of tokenized investment products; Strategy increased its holdings by 34,164 bitcoins last week; KAIO completed a strategic fi...
Stolen: $290 million, Three Parties Refusing to Acknowledge, Who Should Foot the Bill for the KelpDAO Incident Resolution?
An Obscure Open Source AI Tool Alerted on Kelp DAO's $292 million Bug 12 Days Ago
LayerZero reports the KelpDAO theft incident, confirming that it only affects the rsETH configuration
Data: LayerZero "strategic partner" wallet distributes 1.21 million ZRO unlocks to 52 addresses
etherFi: Has suspended LayerZero bridging and frozen multiple asset accesses, currently not directly exposing rsETH risks
Morpho: Suspend the OFT cross-chain bridge for MORPHO on Arbitrum until the root cause of the rsETH incident is identified
FTX/Alameda Wallet Transfers Over $8 Million in ZRO Tokens to Wintermute
Key Takeaways An FTX/Alameda-associated wallet moved 4.126 million ZRO tokens to market maker Wintermute, with an approximate value…
North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…
DeFi Losses Top $600 Million Amid Kelp DAO Exploit and TVL Decline
Key Takeaways: Total DeFi losses have skyrocketed to approximately $1 billion recently, with $600M+ linked directly to the…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Why is a16z Crypto raising another $2.2 billion to heavily invest in Web3?
LayerZero CEO counters KelpDAO: rsETH initially used the default configuration, then manually switched to the not recommended 1/1 configuration
Contents
Latest articles
Latest coin listings on WEEX
