LayerZero Labs
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2BV6dD…WhNQSummary
LayerZero Labs is the Vancouver-based company that develops and maintains the LayerZero cross-chain messaging protocol and the ZRO governance token. The company became the subject of significant controversy following the April 2026 $292 million KelpDAO bridge exploit, in which LayerZero's own infrastructure was compromised and its personnel had previously approved the single-verifier configuration that enabled the attack. LayerZero Labs formally admitted in May 2026 that it 'made a mistake,' after weeks of publicly attributing blame to KelpDAO — a reversal that triggered a broader ecosystem migration estimated at approximately $15 billion in assets moving to competing bridge infrastructure.
Connected Entities
3 entities · 60 linked investigations- LayerZero Labs→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- LayerZero Labs→mentioned with→KelpDAO Bridge Exploit (April 2026)(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→LayerZero Labs(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→KelpDAO Bridge Exploit (April 2026)(80%)
Connected Through
3 shared actors · 88 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaignorganizationalso inNorth Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign·0Atomic Wallet Hack·0June 2026 Cross-Chain Bridge Exploit ($127M)·0Cheil Credit Bank·0ChipMixer·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges·0KelpDAO Bridge Exploit (April 2026)·0KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0AscendEX (BitMax)·0Lazarus Group 'Graphalgo' Fake-Recruiter npm/PyPI Campaign·0Blockchain Bandit·0Lazarus Group Mach-O Man ClickFix macOS Campaign·0Blender.io·0Q2 2026 Bridge Exploit Wave·0Q2 2026 Record Crypto Hack Wave·0Mach-O Man Malware Campaign (Lazarus / Chollima)·0World Cup 2026 — Stake.com Impersonation Wallet Drainer Campaign·0Pump.fun·0Xinbi Guarantee·0HECO Bridge & HTX Exchange Hack·1eXch·2H-Pay Service PLC (Huione Successor Entity)·2Huione Group·2Sinbad.io·2AscendEX Exchange·4Harmony Horizon Bridge·4Heco Bridge·5Huobi / HTX·7Nomad Bridge·8pump.fun·8Orbit Chain Bridge·8Taiko L2 Bridge Exploit June 2026·8AlphaPo·10Euler V1·10Orbit Bridge·10Phemex·10Poloniex·10Harmony Protocol (2026 ONE Token Exploit and L1 Shutdown)·12Tapioca DAO·12The Sandbox SAND — LayerZero Bridge Exploit August 2026·12Garden Finance·14Garden·14Kelp·18OKX DEX·18Pump.fun / Solana Labs / Jito Labs — RICO MEV Class Action (SDNY 2026)·20World Liberty Financial (WLFI)·22Ronin Network·22ALEX Lab·24OKB·25ALEX Lab·28Indodax·28KuCoin·28Stake.com·28Thorchain DEX·28Dunamu / Upbit·30OKX NFT Aggregator·30BingX·32Gate.io·32CoinEx·32KuCoin Exchange Hack·32Nexera·32CoinStats·35Axie Infinity·38BitoPro·38CoinDCX·38Stake.com·38WazirX·38Railgun·40CoinEx Exchange Closure (September 2026)·42NiceHash·42LCX Exchange·52THORChain·52Ronin Bridge·52LayerZero Protocol·55Euler Finance·58Upbit·58LayerZero Executor Wallet Incident (July 2026)·62Hyperliquid·62Safe{Wallet}·68Bybit·72Aave·74ZachXBT·82
- □LayerZero Labsorganizationalso inH1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges·0KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign·0North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign·0Q2 2026 Bridge Exploit Wave·0The Sandbox SAND — LayerZero Bridge Exploit August 2026·12OpenZeppelin AI Exploit Threat Vector·15Kelp·18The Sandbox (SAND)·30LayerZero — DVN Single-Verifier Configuration Risk·32The Sandbox (SAND OFT Exploit)·34LayerZero Protocol·55
- □KelpDAO Bridge Exploit (April 2026)organizationalso inKelpDAO Bridge Exploit (April 2026)·0Lazarus Group Mach-O Man ClickFix macOS Campaign·0June 2026 Cross-Chain Bridge Exploit ($127M)·0Mach-O Man Malware Campaign (Lazarus / Chollima)·0North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign·0Q2 2026 Record Crypto Hack Wave·0OpenZeppelin AI Exploit Threat Vector·15LayerZero — DVN Single-Verifier Configuration Risk·32LayerZero Protocol·55Euler Finance·58
Timeline(13 events)
1 February 2021
LayerZero Labs co-founded by Bryan Pellegrino, Caleb Banister, and Ryan Zarick.
Crunchbase / Sequoia Capital profile1 June 2024
ZRO token launched with 'Proof of Donation' claiming mechanism; token drops 24% on launch day amid community backlash.
FXStreet10 February 2026
LayerZero Labs announces 'Zero' Layer 1 blockchain backed by Citadel Securities, DTCC, ICE, ARK Invest, and Google Cloud.
BusinessWire6 March 2026
Attacker socially engineers a LayerZero Labs developer, harvesting session keys and gaining access to LayerZero's internal RPC cloud environment. Compromised RPC nodes are seeded with poisoned data.
LayerZero Labs KelpDAO Incident Report PDF18 April 2026
$292 million KelpDAO rsETH bridge exploit occurs. Attacker uses poisoned LayerZero RPC nodes and the bridge's 1-of-1 DVN configuration to forge and validate a cross-chain message, releasing 116,500 rsETH.
CoinDesk20 April 2026
LayerZero Labs issues statement attributing the exploit to KelpDAO's application-level configuration choices, and attributes the attack to North Korea's Lazarus Group.
CoinDesk5 May 2026
KelpDAO publicly states that LayerZero personnel had approved KelpDAO's single-verifier configuration before the exploit.
CoinDesk7 May 2026
Solv Protocol announces it is moving approximately $700 million in tokenized bitcoin from LayerZero to Chainlink CCIP.
CoinDesk9 May 2026
LayerZero Labs formally admits it 'made a mistake,' acknowledging that its DVN should not have been permitted to act as a single verifier for high-value transactions. The company states: 'We own that.'
CoinDesk15 May 2026
Approximately $4 billion in assets across multiple protocols have migrated from LayerZero to Chainlink CCIP, including Lombard.
CoinDesk18 May 2026
LayerZero Labs publishes its formal KelpDAO incident report PDF detailing the technical timeline of the March–April 2026 breach.
LayerZero (official)4 August 2026
BitGo's decision to migrate WBTC ($7.4 billion) pushes publicly announced LayerZero-to-Chainlink migrations to nearly $15 billion.
CoinDesk18 August 2026
The state of Wyoming joins the migration, moving its stablecoin infrastructure away from LayerZero.
CoinDeskDecision Log
- hash: DKUyoQGqDMevD8QL59b9Aij1i2NuMmEyP1xdc8qys23z
This investigation is cryptographically anchored to the Solana blockchain (1 event). 21 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/17/2026, 11:04:22 PM
last updated: 9/18/2026, 7:15:04 AM
avoid.net — verified advice for a post-truth world