Key Takeaways
LayerZero’s native token, ZRO, is trying to stabilize.
After dropping around 15% over the past week, the price has edged higher today, showing early signs of recovery.
That bounce comes in the wake of one of the most damaging weekends for DeFi in 2026.
On April 18, KelpDAO suffered a roughly $292 million exploit, which LayerZero initially linked to a highly sophisticated state-backed actor, widely believed to be North Korea’s Lazarus Group.
Now that the narrative around the attack is evolving and LayerZero is pushing back on parts of it, the response could play a key role in whether ZRO avoids another leg lower.
The attack was surgical. Attackers drained 116,500 rsETH, worth about $290 million, from Kelp’s LayerZero-powered bridge by poisoning the servers that LayerZero’s verifier relied on to check transactions.
It did not stop there. Kelp’s emergency pause, 46 minutes after the drain, blocked two follow-up attempts that would have released an additional $200 million in rsETH.
+70
Shiba Inu
Bitcoin
PAX Gold
Ampleforth
Ethereum
Cardano
EOS
Solana
Avalanche
Dogecoin
Ripple
TRON
Bitcoin Cash
Ocean Protocol
Litecoin
Reserve Rights
Ontology
Bitcoin SV
Ethereum Classic
Kusama
Dash
Neo
Chainlink
Qtum
Polkadot
VeChain
Stellar
Tezos
Zcash
Zilliqa
Status
JUST
Cosmos
Ravencoin
Trust Wallet Token
ARPA Chain
Nervos Network
Storj
Beam
NKN
Algorand
Celer Network
THORChain
Fantom
Optimism
Aptos
APEcoin
Wrapped Bitcoin
Compound
Monero
Basic Attention Token
Arweave
Aergo
Decentraland
SushiSwap
Conflux Network
NEAR Protocol
Polkastarter
Ankr
Maker
Artificial Superintelligence Alliance
Mask Network
Cronos
Internet Computer
Badger DAO
USD Coin
BakeryToken
Alpaca Finance
Aave
Treasure
BitTorrent
FLUX
Bancor
IoTex
Build'N'Build
+76
Bitcoin
Ethereum
Tether
USD Coin
Solana
Ripple
Dogecoin
Cardano
Toncoin
Shiba Inu
Avalanche
TRON
Chainlink
Polygon Matic
Polkadot
Wrapped Bitcoin
Litecoin
Dai
NEAR Protocol
Bitcoin Cash
Stellar
Cosmos
Filecoin
Ethereum Classic
Aptos
Hedera Hashgraph
Immutable
Optimism
Arbitrum
VeChain
The Sandbox
Decentraland
Axie Infinity
Injective Protocol
Render
The Graph
Aave
Chiliz
Helium
PAX Gold
Compound
Lido DAO Token
Sui
Conflux Network
Lido Staked ETH
OKB
Uniswap
Pepe
Ondo
Mantle
First Digital USD
XDC Network
Artificial Superintelligence Alliance
Jupiter
Quant
Worldcoin
Bonk
Tether Gold
JITO
JasmyCoin
Core
Floki Inu
Ethereum Name Service
SushiSwap
1inch Network
Tezos
Algorand
Flow
Trust Wallet Token
Curve DAO Token
MultiversX
Basic Attention Token
Enjin Coin
Ethena
Ethena Staked USDe
Build'N'Build
Kava.io
Celestia
Sei
IOTA
Frax
+217
Bitcoin
Ethereum
Tether
Build'N'Build
USD Coin
Solana
Ripple
Dogecoin
Cardano
Toncoin
Shiba Inu
Avalanche
TRON
Chainlink
Polkadot
Polygon Matic
Wrapped Bitcoin
Litecoin
Dai
NEAR Protocol
Bitcoin Cash
Monero
Stellar
Cosmos
Filecoin
Ethereum Classic
Aptos
Hedera Hashgraph
Immutable
Optimism
Arbitrum
VeChain
The Sandbox
Decentraland
Axie Infinity
Injective Protocol
Render Token
The Graph
Maker
Aave
Chiliz
Helium
PAX Gold
Compound
Lido DAO Token
THORChain
Stacks
Arweave
Sui
Conflux Network
Lido Staked ETH
Bitget Token
Wrapped Ethereum
OKB
Uniswap
Pepe
Ondo
Mantle
First Digital USD
Bittensor
Kaspa
Celestia
XDC Network
Artificial Superintelligence Alliance
Jupiter
Quant
Worldcoin
PayPal USD
Bonk
Flare
Tether Gold
Sei
JITO
JasmyCoin
PancakeSwap
Core
Floki Inu
Ethereum Name Service
SushiSwap
Kava.io
1inch Network
Tezos
Algorand
Flow
Trust Wallet Token
Curve DAO Token
KuCoin Token
MultiversX
Gitcoin
Zcash
IOTA
Basic Attention Token
Frax
Ethena
Ethena USDe
Fasttoken
Pi Network
SATS
Adventure Gold
Audius
Alchemy Pay
Arkham
API3
Bounce Token
Altlayer
Aergo
Amp
Aevo
ARPA Chain
Astar
Ark
Ankr
AirSwap
Alpaca Finance
Blur
Badger DAO
Bancor
BakeryToken
Biconomy
Chromia
Celer Network
Celo
Shentu
Civic
Convex Finance
Cartesi
Cyber
COTI
DigiByte
DIA
ether.fi
FUNToken
FLUX
Firo
Ampleforth
Golem
GMX
Gnosis
Moonbeam
Holo
IoTex
ICON
Illuvium
JUST
Kadena
Liquity
Livepeer
Lisk
Memecoin
Manta Network
Treasure
Mask Network
MetisDAO
Origin Protocol
ORDI
Ontology
Osmosis
Powerledger
Phala Network
Pendle
Portal
Pyth Network
ConstitutionDAO
Polkastarter
Qtum
iExec RLC
Rocket Pool
Reserve Rights
Ronin
Ravencoin
Starknet
Storj
Status
Spell Token
Sun (New)
SuperVerse
Toko Token
Theta Fuel
Tellor
Tensor
LayerZero
Usual
Eigenlayer
Hamster Kombat
Catizen
Berachain
KAITO
Pudgy Penguins
Solayer
Bio Protocol
ChainGPT
Cookie DAO
Solv Protocol
Alchemix
Bitcoin SV
Movement
DeXe
Binance Staked SOL
Nexo
Wrapped eETH
Hyperliquid
Casper
Zilliqa
Secret
Nervos Network
TrueUSD
BitTorrent
Mina
Dash
STEPN
Gemini Dollar
UNUS SED LEO
Synthetix
APEcoin
Gala
Theta Network
Fantom
Cronos
Internet Computer
Binance USD
The method was sophisticated. Attackers first compromised the downstream RPC used by the DVN, then launched a DDoS attack on other nodes to force a failover to the poisoned endpoint.
From there, the attacker tricked LayerZero’s cross-chain messaging layer into believing a valid instruction had arrived from another network, which triggered Kelp’s bridge to release 116,500 rsETH to an attacker-controlled address.
Meanwhile, on-chain data from Santiment shows that ZRO initially dropped while the DAA divergence turned negative.
That implied that price was falling faster than network activity, signaling weak demand and confirming the downside move.
Now, the metric has shifted back into positive territory while LayerZero’s price is starting to recover.
This indicates that on-chain activity is growing faster than the price, suggesting improving underlying demand and early accumulation.
By the look of things, the positive DAA divergence could keep ZRO’s price recovering and pushing back toward the $2.10 range.

However, if the divergence starts declining while the price is still rising, that weakening support could lead to a rejection and a pullback toward the $1.50 area.
Despite the change in market sentiment, LayerZero moved quickly to contain the narrative.
“We’re fully aware of the rsETH exploit and have been in active remediation with the KelpDAO team since the incident, and continue to monitor. All other applications remain safe,” LayerZero said.
Then came the blame. LayerZero argued that the incident was isolated to KelpDAO’s rsETH configuration, a direct consequence of their single-DVN setup.
However, the team was blunt.
“KelpDAO chose to utilize a 1/1 DVN configuration. A properly hardened configuration would have required consensus across multiple independent DVNs, rendering this attack ineffective even in the event of any single DVN being compromised,” LayerZero wrote.
On contagion, LayerZero was firm.
“We can confirm with confidence that there is zero contagion to any other asset or application,” They stated.
KelpDAO, however, pushed back on that narrative.
As CCN reported earlier, the protocol disputed LayerZero’s account, arguing that the compromised single-verifier setup relied on LayerZero’s own infrastructure and default configurations—not a custom setup it chose against guidance.
In KelpDAO’s view, responsibility does not sit solely with the protocol.
The team said it relied on LayerZero’s documentation, default settings, and direct guidance when configuring the system.
Some security researchers appear to support that position.
For example, Yearn Finance core developer Artem K shared a technical review of LayerZero’s public deployment code, noting that the reference setup itself uses single-source verification.
Chainlink community liaison Zach Rynes also weighed in:
“As anticipated, LayerZero is deflecting accountability that their very own DVN node infrastructure was compromised and triggered a $290 million bridge exploit.”
The back-and-forth highlights a broader issue: in complex, interconnected systems like DeFi, assigning responsibility is rarely straightforward.
Outside the blame game, data from Glassnode shows that it might not yet be time for glitz and glamour for the altcoin.
At the time of writing, ZRO’s price has been relatively stable. However, transfers to exchanges have surged, which is typically a warning signal.
This spike in exchange inflows has shown that more holders are moving tokens to sell-side venues, increasing available supply.
Even if the price has not reacted immediately, this kind of behavior has often preceded distribution phases.
Previously, smaller spikes in transfers have coincided with short-term tops or local pullbacks, and the current spike is significantly larger.
If these inflows persist, LayerZero could face downside pressure, with price likely to retest lower levels closer to $1.

However, if inflows drop quickly and demand absorbs the supply released by the token unlock, the price could stabilize. For now, the setup looks like a double-edged sword.
From a technical perspective, the daily chart shows that ZRO’s price dropped into the $1.50 support zone after rejection near the $2 resistance earlier.
However, at press time, the Chaikin Money Flow (CMF) has been trending upward, showing that buying pressure has been building despite the pullback.
Interestingly, the technical setup looks similar to the period ZRO surged by 85% after breaking out of a falling wedge.
Besides that, this divergence suggests that capital has been flowing in while the price has been correcting.
This is typically a sign of accumulation rather than weakness. But when this is combined with the earlier spike in exchange transfers, the picture becomes mixed.
Buying pressure has been increasing alongside supply on exchanges, meaning any recovery is facing overhead sell pressure.
If the CMF continues to rise and the price holds above $1.50, ZRO could rebound toward $2.06 near the 0.618 golden ratio.

But if selling from those exchange inflows starts dominating, the support could break, and the price will likely slide below $1.52.
In that scenario, the altcoin risks a 30% drop toward $1.18.
As of yesterday, LayerZero is already taking action.
The team has vowed to stop signing messages for any application using a single-verifier setup, forcing a broad migration across its ecosystem.
Recovery efforts are also underway. LayerZero says it has replaced the affected RPC endpoint, restored DVN operations, and is working with KelpDAO, SEAL, and law enforcement agencies to trace funds.
The blame war, however, is far from settled. Both sides are pointing fingers.
The community is divided, and LayerZero’s price remains caught in the middle, hovering above its all-time low, waiting to see who the market ultimately believes.
Victor Olanrewaju is a crypto analyst and reporter at CCN with deep roots in on-chain research and technical analysis. His crypto journey began in 2017, but it was the 2020 Uniswap airdrop that sparked a full-time pivot into the space.
With a foundation in copywriting, Victor honed his craft creating high-converting content for leading crypto brokers — most notably an XRP price prediction that ranked #1 on Google during the 2021 bull run.
He later joined AMBCrypto in 2022, where he combined storytelling with technical and on-chain analysis to cover key market narratives.
In 2024, he expanded his expertise at BeInCrypto, collaborating with analysts and using tools like Glassnode, Santiment, and IntoTheBlock to break down Bitcoin and altcoin trends.
At CCN, Victor covers the top cryptocurrencies, memecoins, macro shifts, blending real-time insights with deep-dive metrics.
He holds a Bachelor’s degree in Physics from the University of Ibadan, equipping him to simplify complex data for a wide audience. Follow his work or connect on LinkedIn or X.
You’re All Set!
Thanks for signing up. We’ll be in touch soon with the latest insights.
