LayerZero Executor Wallet Incident (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4PX4Rh…NegrSummary
On July 15, 2026, security firm PeckShield and on-chain analyst Specter reported that LayerZero executor wallets appeared to have been drained of approximately $2.4 million across eight blockchain networks. LayerZero Core responded the same day, stating the transfers were routine internal inventory rebalancing and that no exploit had occurred and no user funds were at risk. The incident was not independently confirmed as a security breach, and as of the date of this investigation LayerZero's denial has not been publicly contradicted by on-chain forensic analysis or a third-party post-mortem.
Connected Entities
1 entitiesTimeline(7 events)
18 April 2026
Kelp DAO bridge exploit drains approximately $292 million from a LayerZero-connected bridge. LayerZero later attributes the attack to North Korea's Lazarus Group (TraderTraitor cluster) and a single-DVN configuration failure in Kelp DAO's setup.
CoinDesk / Chainalysis5 May 2026
Kelp DAO publicly disputes LayerZero's post-mortem, claiming LayerZero had approved the single-DVN configuration it later criticized.
CoinDesk9 May 2026
LayerZero acknowledges it 'made a mistake' in connection with the Kelp DAO exploit.
CoinDesk15 July 2026
PeckShield and on-chain analyst Specter post alerts on X flagging anomalous outflows from LayerZero executor wallets across eight blockchain networks, reporting approximately $2.1–2.4 million in assets moved and bridged to Ethereum.
Bloomingbit / Blockchain Reporter15 July 2026
LayerZero Core issues a same-day denial, stating the transfers were routine internal inventory rebalancing and that no hack occurred and no user funds were at risk.
Bloomingbit15 July 2026
Multiple crypto media outlets including Cryptonomist, Blockchain Reporter, and Coinpedia publish articles characterizing the incident as a confirmed or suspected hack; Live Bitcoin News subsequently publishes the LayerZero denial and characterizes the alarm as a false alarm.
Live Bitcoin News24 July 2026
LayerZero publishes a support update blog post following the incident.
LayerZero official blogDecision Log
- hash: 8bWetzLekgFEbxURpjcn3vp4XQvkeNbTBy3KRdUBRrqq
This investigation is cryptographically anchored to the Solana blockchain (1 event). 13 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/15/2026, 12:07:04 PM
last updated: 9/15/2026, 7:24:02 PM
avoid.net — verified advice for a post-truth world