Lazarus Group’s TraderTraitor cluster is preliminarily linked to a $292M KelpDAO rsETH bridge exploit that abused a 1-of-1 LayerZero DVN setup rather than a smart contract flaw. The attacker allegedly poisoned RPC infrastructure used by LayerZero’s DVN, forced failover from clean nodes, and made the verifier accept a forged Unichain message for a nonexistent 116,500 rsETH burn. The forged attestation released rsETH on Ethereum, after which attacker-controlled EOAs used the unbacked collateral in DeFi lending markets to borrow and consolidate ETH. KelpDAO paused the protocol 46 minutes after the drain, blocking two further forged-message attempts, while Arbitrum later froze 30,766 ETH linked to the exploit.