LayerZero Labs Addresses Security Incident and Unveils Recovery Plan

LayerZero Labs, the developer behind the prominent omnichannel interoperability protocol, has officially apologized for a recent security breach involving its infrastructure. On May 9, 2026, the team released a detailed disclosure via the X platform, acknowledging a series of technical failures and communication lapses that occurred over the preceding three weeks. While the protocol’s core architecture remained intact, the incident exposed vulnerabilities within the Decentralized Verifier Networks (DVNs) and internal operational procedures.

Analysis of the Lazarus Group Attack and RPC Failures

The security compromise was the result of a coordinated effort attributed to the Lazarus Group, a sophisticated cyber-espionage entity. According to the report, the attackers targeted the project's internal Remote Procedure Call (RPC) nodes. Simultaneously, external RPC providers were hit by Distributed Denial of Service (DDoS) attacks, leading to the contamination of data sources utilized by the DVNs. RPCs are critical gateways that allow applications to interact with blockchain networks.

The team identified specific operational oversights that exacerbated the situation:

• The system mistakenly permitted DVNs to process high-value transactions using a 1/1 configuration, lacking the necessary redundancy.
• There was an admitted failure in supervising the specific content protected by individual verifiers.
• The breach impacted a single application, representing 0.14% of the total applications on LayerZero and 0.36% of the total asset value secured by the protocol.

Internal Governance and Rectification Measures

Beyond the external attack, LayerZero Labs disclosed a long-standing governance risk dating back over three years. A multisig signer was found to have misused a hardware wallet for personal transactions. In response, the organization has removed the individual, rotated the multisig wallets, and developed a proprietary multisig system known as OneSig to prevent future unauthorized use.

The protocol itself was not affected, but the team mistakenly allowed DVNs to handle high-value transactions with a 1/1 configuration... constituting an unrecognized risk.

The rectification strategy involves a complete overhaul of how DVNs interact with data sources and a transition to more robust security configurations. By implementing OneSig, the project aims to standardize signer behavior and enhance the transparency of internal fund management across all supported blockchains.

The disclosure marks a pivot toward greater transparency for LayerZero as it seeks to maintain its position in the competitive cross-chain landscape. By detailing the specifics of the Lazarus Group's tactics and acknowledging internal errors, the team intends to fortify the trust of the decentralized finance (DeFi) community. Moving forward, the focus will remain on the deployment of more resilient data source monitoring to mitigate the impact of future DDoS or RPC-level attacks.