Lido：ZKsync wstETH桥接端点合约存在潜在漏洞

KelpDAO Loses $290M in Lazarus Group LayerZero Attack

KelpDAO faced a $290 million loss due to a sophisticated security breach linked to the Lazarus Group. The attack exploited configuration weaknesses in their verification system and highlighted the risks of relying on a single-point verification setup. Industry experts emphasize the need for improved security configurations and multi-layer verification to prevent future incidents.

LayerZero 回應 Kelp DAO 2.92 億事件：指 Kelp 自選 1-of-1 DVN 配置，駭客為北韓 Lazarus

LayerZero 針對 Kelp DAO 2.92 億美元遭駭事件發表聲明，指責 Kelp 自選 1-of-1 DVN 配置使事件成為可能，攻擊者為北韓 Lazarus 集團。LayerZero 強調此事件源於配置選擇，並將不再支持此類脆弱設置。此外，責任歸屬仍存爭議，未提供賠償方案。

DeFi 駭客 4 月盜走 6 億美元，Kelp DAO 和 Drift 佔月度損失 95%

2026 年 4 月僅 20 天內，加密協議因駭客攻擊損失超過 6.06 億美元，成為自 2025 年 2 月交易所 14 億美元資料外洩事件以來最嚴峻的單月損失紀錄。KelpDAO 和 Drift Protocol 兩起攻擊合計佔 4 月損失的 95%，以及 2026 年截至目前 7.718 億美元總損失的 75%。

Vercel Breach Linked to AI Tool Context.ai Compromise Raises Risk for Crypto Frontends

Vercel confirmed a security breach caused by a compromised AI tool, leading to the theft of employee and customer data. The incident poses risks to the Web3 ecosystem, and the attacker is attempting to sell the stolen data for $2 million. Vercel is addressing the situation with law enforcement and incident response experts.

Ripple CTO: Kelp DAO Exploit Reflects Bridge Security Trade-Offs

David Schwartz, CTO Emeritus at Ripple, analyzed bridge security vulnerabilities following the $292 million Kelp DAO exploit. He noted that providers prioritized convenience over robust security, undermining essential protective features. The Kelp DAO breach stemmed from a private key leak, exacerbated by a simplified security configuration in their LayerZero implementation.

rsETH LayerZero 橋被盜，Aave 等多協議緊急凍結

Kelp DAO 的流動性再質押代幣 rsETH 在 4 月 19 日遭到黑客利用跨鏈消息驗證漏洞攻擊，導致 116,500 枚 rsETH 被釋放至攻擊者控制的地址。多個 DeFi 協議緊急凍結相關功能，以應對潛在損失。LayerZero 官方表示正在積極修復漏洞，並將發佈事後分析報告。