North Korea’s Lazarus APT stole $290M from Kelp DAO

North Korea-linked Lazarus Group (TraderTraitor) exfiltrated $290M from Kelp DAO by compromising two RPC nodes used by LayerZero’s DVN, performing RPC-spoofing and DDoS to force reliance on the compromised nodes; a subsequent ~$95M theft attempt was mitigated after Kelp paused contracts and blacklisted wallets. The report attributes the breach to Kelp’s single-verifier (1-of-1) DVN configuration, notes LayerZero and partners’ containment and remediation actions, and highlights the attack as a sophisticated state-level targeting of off-chain infrastructure.