Key Takeaways
LayerZero’s native token, ZRO, is trying to stabilize.
After dropping around 15% over the past week, the price has edged higher today, showing early signs of recovery.
That bounce comes in the wake of one of the most damaging weekends for DeFi in 2026.
On April 18, KelpDAO suffered a roughly $292 million exploit, which LayerZero initially linked to a highly sophisticated state-backed actor, widely believed to be North Korea’s Lazarus Group.
Now that the narrative around the attack is evolving and LayerZero is pushing back on parts of it, the response could play a key role in whether ZRO avoids another leg lower.
The attack was surgical. Attackers drained 116,500 rsETH, worth about $290 million, from Kelp’s LayerZero-powered bridge by poisoning the servers that LayerZero’s verifier relied on to check transactions.
It did not stop there. Kelp’s emergency pause, 46 minutes after the drain, blocked two follow-up attempts that would have released an additional $200 million in rsETH.
+81
+76
+217
The method was sophisticated. Attackers first compromised the downstream RPC used by the DVN, then launched a DDoS attack on other nodes to force a failover to the poisoned endpoint.
From there, the attacker tricked LayerZero’s cross-chain messaging layer into believing a valid instruction had arrived from another network, which triggered Kelp’s bridge to release 116,500 rsETH to an attacker-controlled address.
Meanwhile, on-chain data from Santiment shows that ZRO initially dropped while the DAA divergence turned negative.
That implied that price was falling faster than network activity, signaling weak demand and confirming the downside move.
Now, the metric has shifted back into positive territory while LayerZero’s price is starting to recover.
This indicates that on-chain activity is growing faster than the price, suggesting improving underlying demand and early accumulation.
By the look of things, the positive DAA divergence could keep ZRO’s price recovering and pushing back toward the $2.10 range.

However, if the divergence starts declining while the price is still rising, that weakening support could lead to a rejection and a pullback toward the $1.50 area.
Despite the change in market sentiment, LayerZero moved quickly to contain the narrative.
“We’re fully aware of the rsETH exploit and have been in active remediation with the KelpDAO team since the incident, and continue to monitor. All other applications remain safe,” LayerZero said.
Then came the blame. LayerZero argued that the incident was isolated to KelpDAO’s rsETH configuration, a direct consequence of their single-DVN setup.
However, the team was blunt.
“KelpDAO chose to utilize a 1/1 DVN configuration. A properly hardened configuration would have required consensus across multiple independent DVNs, rendering this attack ineffective even in the event of any single DVN being compromised,” LayerZero wrote.
On contagion, LayerZero was firm.
“We can confirm with confidence that there is zero contagion to any other asset or application,” They stated.
KelpDAO, however, pushed back on that narrative.
As CCN reported earlier, the protocol disputed LayerZero’s account, arguing that the compromised single-verifier setup relied on LayerZero’s own infrastructure and default configurations—not a custom setup it chose against guidance.
In KelpDAO’s view, responsibility does not sit solely with the protocol.
The team said it relied on LayerZero’s documentation, default settings, and direct guidance when configuring the system.
Some security researchers appear to support that position.
For example, Yearn Finance core developer Artem K shared a technical review of LayerZero’s public deployment code, noting that the reference setup itself uses single-source verification.
Chainlink community liaison Zach Rynes also weighed in:
“As anticipated, LayerZero is deflecting accountability that their very own DVN node infrastructure was compromised and triggered a $290 million bridge exploit.”
The back-and-forth highlights a broader issue: in complex, interconnected systems like DeFi, assigning responsibility is rarely straightforward.
Outside the blame game, data from Glassnode shows that it might not yet be time for glitz and glamour for the altcoin.
At the time of writing, ZRO’s price has been relatively stable. However, transfers to exchanges have surged, which is typically a warning signal.
This spike in exchange inflows has shown that more holders are moving tokens to sell-side venues, increasing available supply.
Even if the price has not reacted immediately, this kind of behavior has often preceded distribution phases.
Previously, smaller spikes in transfers have coincided with short-term tops or local pullbacks, and the current spike is significantly larger.
If these inflows persist, LayerZero could face downside pressure, with price likely to retest lower levels closer to $1.

However, if inflows drop quickly and demand absorbs the supply released by the token unlock, the price could stabilize. For now, the setup looks like a double-edged sword.
From a technical perspective, the daily chart shows that ZRO’s price dropped into the $1.50 support zone after rejection near the $2 resistance earlier.
However, at press time, the Chaikin Money Flow (CMF) has been trending upward, showing that buying pressure has been building despite the pullback.
Interestingly, the technical setup looks similar to the period ZRO surged by 85% after breaking out of a falling wedge.