SlowMist’s Cosine breaks down the KelpDAO attack process

According to ChainCatcher, as analyzed by SlowMist founder Yu Jian (@evilcos), the core of the recent KelpDAO exploit, which resulted in a theft of approximately $290 million, was a targeted poisoning attack against the downstream RPC infrastructure of LayerZero DVN (Decentralized Verifier Network).

The specific steps of the attack were as follows: first, the attacker obtained the list of RPC nodes used by LayerZero DVN, then compromised two independent clusters and replaced the op-geth binary files. Using selective spoofing techniques, the attacker returned forged malicious payloads only to DVN, while returning genuine data to other IPs. Meanwhile, a DDoS attack was launched against the uncompromised RPC nodes, forcing DVN to fail over to the poisoned nodes. After forging message validation, the malicious binaries self-destructed and logs were cleared. Ultimately, LayerZero DVN ended up signing validations for “transactions that never actually occurred.”