LayerZero has released a detailed report on the rsETH attack that occurred on April 18, affecting the KelpDAO rsETH bridge. The breach resulted in the theft of approximately 116,500 rsETH, valued at around $292 million. Security firms have linked the attack to the North Korean hacking group TraderTraitor (UNC4899). The attack exploited a single-validator configuration in KelpDAO's bridge, using social engineering to compromise a LayerZero Labs developer's session key and infiltrate their RPC cloud environment. The attacker manipulated internal RPC nodes to provide false blockchain state information, enabling the generation of valid proofs for forged cross-chain messages. This led to the unauthorized unlocking of rsETH. In response, LayerZero Labs has rebuilt its infrastructure with a zero-trust architecture and implemented stricter security measures, including requiring minimum security configurations for channels involving its Decentralized Verifier Network. The company is also collaborating with law enforcement and security firms to track the stolen funds.