North Korean hackers from Lazarus compromised one of the largest ETH staking protocols with a TVL of $1.6 billion, rsETH (issued by Kelp). Following the hack, the attackers withdrew 116,500 rsETH ($293 million) from the Kelp cross-chain bridge based on LayerZero. The hackers deposited the stolen tokens as collateral on Aave v3 and obtained wETH. They borrowed $196 million on the platform, and their total positions across Aave, Compound, and Euler reached $236 million. This led to the TVL of all DeFi dropping by $13.8 billion (14%) — from $99.5 billion to $85.7 billion. Users fear that the losses might be distributed among them. Kelp DAO used a 1/1 DVN configuration in their bridge (one validator approval – cheaper and faster) instead of the recommended 2/2 by LayerZero. Following this incident, LayerZero announced that LayerZero Labs DVN would no longer sign or confirm messages from applications using the 1/1 configuration. Previously, Lazarus also hacked Ronin ($625 million), Bybit ($1.5 billion), and Drift Protocol ($280 million).