LayerZero Update
Contents
First things first: an overdue apology.
We’ve done a terrible job on comms over the past three weeks. We wanted to prioritize completeness in the form of a comprehensive post-mortem, but we should have led with directness. While the LayerZero protocol remained unaffected, our own internal RPCs that the LayerZero Labs DVN used were attacked by the Lazarus Group and had their source of truth poisoned while our external RPC provider were simultaneously DDOS’d.
We believe developers should choose their own security configurations, but we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions. We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that. Moving forward, LayerZero Labs will be more active in educating developers and monitoring how applications should build on the protocol to ensure they are configured safely.
This impacted a single application (0.14% …
We’ve done a terrible job on comms over the past three weeks. We wanted to prioritize completeness in the form of a comprehensive post-mortem, but we should have led with directness. While the LayerZero protocol remained unaffected, our own internal RPCs that the LayerZero Labs DVN used were attacked by the Lazarus Group and had their source of truth poisoned while our external RPC provider were simultaneously DDOS’d.
We believe developers should choose their own security configurations, but we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions. We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that. Moving forward, LayerZero Labs will be more active in educating developers and monitoring how applications should build on the protocol to ensure they are configured safely.
This impacted a single application (0.14% …