Attackers exploited LayerZero Labs infrastructure on 18 April 2026, causing more than $300 million in losses across DeFi protocols and prompting two additional forged transactions totaling over $100 million before Kelp paused contracts. The excerpt says independent researchers tied the theft of 116,500 rsETH to DPRK-linked threat actors with high confidence, through a fraudulent attestation from the LayerZero DVN. Public data cited in the excerpt shows the 1-1 LayerZero Labs DVN setup was widely used, with more than 120 OFTs relying on it and about 90% of LayerZero messages including the LayerZero Labs DVN. LayerZero acknowledged attackers compromised two RPC nodes used by its DVN and swapped binaries on op-geth nodes, while independent researchers characterized the event as an infrastructure breach inside LayerZero's trust layer rather than a simple app configuration issue.