An attacker drained 116,500 rsETH worth $292 million on April 18, 2026, through cross-chain message forgery on the LayerZero bridge. The heist, recorded as the largest DeFi exploit of the year, stemmed from a single fatal vulnerability: a 1-of-1 DVN configuration, where billions of dollars in security were guarded by just one verifier operated by LayerZero Labs itself.
The operation had apparently been running since March 6, 2026. Attackers deceived LayerZero developers through social engineering, stole session keys, and then poisoned internal RPC nodes. A joint investigation by Mandiant, CrowdStrike, and independent researchers pointed to a single culprit: the TraderTraitor cluster of the North Korean hacker group Lazarus.
The impact spread rapidly. Aave was forced to freeze rsETH markets in versions V3 and V4 to prevent further contagion, triggering a liquidation process that took weeks. Out of the total stolen funds, $175 million in ETH has been funneled to private channels, while another $71 million in ETH was successfully locked by Arbitrum.
More Than Just a Loss of Funds
The loss of $292 million in assets shattered institutional trust. An exodus became inevitable as nearly $15 billion in capital began flowing out of the LayerZero ecosystem toward Chainlink CCIP.
The list of migrating protocols includes major names. BitGo moved $7.4 billion in WBTC operations, followed by Kraken with their kBTC product. Lombard withdrew more than $1 billion of its assets, while Solv Protocol relocated $700 million. Other entities like Mantle, Virtuals, and Re also shifted course. Even Nethermind, the company that previously served as a verifier operator for LayerZero, chose to step down and join as a Chainlink node operator.
The heaviest blow came from the government sector. The Wyoming Stable Token Commission decided that the Frontier Stable Token - the first state-issued stablecoin in the United States - will now run exclusively on Chainlink CCIP. The Wyoming government cited weaknesses in LayerZero’s disclosure practices and operational security as the primary reason for this transition.
A Late Acknowledgment
Under rising market pressure, LayerZero finally broke its silence on May 9, 2026. The company admitted it had made a mistake by allowing its own verifier to secure high-value assets in a risky configuration. However, this acknowledgment failed to halt the wave of departures of major partners.
More than 10 protocols and one government entity have now confirmed their move to alternative infrastructure. In an industry that relies on code security, the failure of a single configuration proved sufficient to tear down years of business. The $15 billion in capital has reacted, and it has reacted by leaving LayerZero.
Reported from crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
