LayerZero: Multisignature security mechanism has been updated

Odaily reports that LayerZero Labs posted on X, stating that the internal RPC used by LayerZero Labs was attacked by the Lazarus Group over the past three weeks, resulting in the compromise of the real source of their DVN (decentralized verification network), while external RPC providers suffered DDOS attacks. This incident affected 0.14% of applications and approximately 0.36% of asset value. LayerZero Labs indicated that assets are currently secure, and since April 19, over 9 billion USD has been transferred cross-chain through the protocol.

In response to security risks, LayerZero Labs has stopped providing services for its DVN with 1/1 configuration, and all pathways will be migrated by default to at least 3/3 or 5/5 multi-DVN models. Additionally, regarding the incident three years ago in which multisig holders mistakenly used hardware wallets for personal transactions, LayerZero Labs has removed that signer and replaced the wallet, while also developing the custom OneSig multisig system. LayerZero Labs recommends that developers lock configurations to avoid relying on default settings, and plans to launch the asset management platform Console to strengthen security monitoring.