The attack carried the markings of “a highly-sophisticated state actor, likely DPRK’s Lazarus Group,” LayerZero said, specifying the group’s TraderTraitor subunit.
LayerZero said that KelpDAO had used a single verifier to approve transfers in and out of the bridge, adding that it had repeatedly urged KelpDAO to use multiple verifiers instead.
Going forward, LayerZero said it will stop approving messages for any application still running that setup.
A single point of failureObservers say the exploit exposed how the bridge was built to trust a single verifier.
It was “a single point of failure, regardless of what the marketing calls it,” Shalev Keren, co-founder at cryptographic security firm Sodot, told Decrypt.
A single compromised checkpoint was enough to allow the funds to leave the bridge, and no audit or security review could have fixed that flaw without “removing unilateral trust from the architecture itself,” Keren said.
The attackers came within three minutes of draining another $100 million before a rapid blacklist cut them off, according to an analysis by blockchain security firm Cyvers. The operation was based on tricking a single channel of communication, Cyvers CTO Meir Dolev told Decrypt.
Attackers tapped two of the lines the verifier used to check whether a withdrawal had actually occurred on Unichain, fed it a fake “yes” on those lines, then knocked the remaining lines offline to force the verifier to rely on the compromised ones.
“The vault was fine. The guard was honest. The door mechanism worked correctly,” Dolev said. “The lie was whispered directly to the one party whose word opened the door.”
But while LayerZero, whose infrastructure powered the drained bridge, pointed to Lazarus as the likely culprit, Cyvers stopped short of the same attribution in its own analysis.
The malicious node software was engineered to erase itself once the attack finished, wiping binaries and logs to obscure the attackers’ trail in real time and in the post-mortem, he added.
Dolev noted that the Drift hack was “very different in terms of the preparations and execution,” but both attacks required long lead times, deep expertise, and significant resources to pull off.
