Skip to main content
AVOID.NET

LayerZero Executor Wallet Incident (July 2026)

avoid.net/layerzero-executor-wallet-incident-july-202662/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4PX4Rh…Negr

Summary

On July 15, 2026, security firm PeckShield and on-chain analyst Specter reported that LayerZero executor wallets appeared to have been drained of approximately $2.4 million across eight blockchain networks. LayerZero Core responded the same day, stating the transfers were routine internal inventory rebalancing and that no exploit had occurred and no user funds were at risk. The incident was not independently confirmed as a security breach, and as of the date of this investigation LayerZero's denial has not been publicly contradicted by on-chain forensic analysis or a third-party post-mortem.

Connected Entities

1 entities
Organizations
LayerZero Executor Wallet Incident (July 2026)
Relationships
    Have evidence about LayerZero Executor Wallet Incident (July 2026)?

    Timeline(7 events)

    18 April 2026

    Kelp DAO bridge exploit drains approximately $292 million from a LayerZero-connected bridge. LayerZero later attributes the attack to North Korea's Lazarus Group (TraderTraitor cluster) and a single-DVN configuration failure in Kelp DAO's setup.

    CoinDesk / Chainalysis

    5 May 2026

    Kelp DAO publicly disputes LayerZero's post-mortem, claiming LayerZero had approved the single-DVN configuration it later criticized.

    CoinDesk

    9 May 2026

    LayerZero acknowledges it 'made a mistake' in connection with the Kelp DAO exploit.

    CoinDesk

    15 July 2026

    PeckShield and on-chain analyst Specter post alerts on X flagging anomalous outflows from LayerZero executor wallets across eight blockchain networks, reporting approximately $2.1–2.4 million in assets moved and bridged to Ethereum.

    Bloomingbit / Blockchain Reporter

    15 July 2026

    LayerZero Core issues a same-day denial, stating the transfers were routine internal inventory rebalancing and that no hack occurred and no user funds were at risk.

    Bloomingbit

    15 July 2026

    Multiple crypto media outlets including Cryptonomist, Blockchain Reporter, and Coinpedia publish articles characterizing the incident as a confirmed or suspected hack; Live Bitcoin News subsequently publishes the LayerZero denial and characterizes the alarm as a false alarm.

    Live Bitcoin News

    24 July 2026

    LayerZero publishes a support update blog post following the incident.

    LayerZero official blog
    Provenance & Audit Trail

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 13 of 13 cited source URLs have an Internet Archive snapshot.

    model: claude-sonnet-4-6

    generated: 9/15/2026, 12:07:04 PM

    last updated: 9/15/2026, 7:24:02 PM

    avoid.net — verified advice for a post-truth world