# @banteg: LayerZero attack was infra breach, not RPC poisoning

Source: https://firefly.social/post/x/2046124661352644907?sid=1506745023

## Summary

The post argues that the LayerZero attack was an infrastructure breach inside the trust boundary, not RPC poisoning, which the author describes as an outside attacker tainting a shared lookup. According to the post, the attackers accessed LayerZero's RPC list, compromised two nodes the DVN depended on, and swapped the op-geth binaries. The malicious binary reportedly hid its IP, served forged payloads only to the DVN while giving accurate responses to scans and other callers, and then self-destructed to wipe logs and binaries.

## Article

layerzero attack was not rpc poisoning

in networking poisoning is when the attacker outside the trust boundary taints a shared lookup (dns, arp, cache). the consumer has no reason to distrust the source.

this was not that.

the attackers got inside layerzero's trust boundary. they accessed the rpc list, compromised two nodes the dvn depended on, and swapped the op-geth binaries. that's an infra breach within the perimeter. supply-chain shaped, not network shaped.

and the payload was surgical. the malicious binary cloaked by ip, served forged payload only to the dvn, told the truth to scan and every other caller, then self-destructed to wipe logs and binaries.

rpc poisoning makes it sound like something that happened to the infra from the outside. the real story is a targeted implant operating inside the trust boundary.

that's a meaningfully scarier attack than the label suggests.

## Comments

**timdaub.eth**: Accidentially submitted the same but removing my link from the feed: https://news.kiwistand.com/stories/banteg-LayerZero-attack-was-infra-breach-not-RPC-poisoning?index=0x69e5d7fa6a6d85ef8181843fc5d7e96122c9198c66693ca0540c95d39fa3714d7233b9c4

**mishaderidder.eth**: The question for today, was the DPRK was inside their infrastructure or is it all a psyop ;) ? And what about the silence of KelpDAO? 
https://firefly.social/post/x/2046133436801491114?sid=1506745023

**rvolz.eth**: > At this point, do we still need DeFi? Is every bit of freedom (and yield) worth the risk?

This question was raised in various forms over the weekend. The quote's author argued that the sector needs to step up security (https://x.com/Eli5defi/status/2043690690069004323) urgently and publicly. 

Other comments I read were not so nice and suggested getting out of the sector entirely. But what remains of ETH without DeFi?


**mishaderidder.eth**: fundamentally, nfts are a better fit for blockchain tech than defi is: https://firefly.social/post/x/2045979911563645070?sid=1506745023

**timdaub.eth**: Hahah if only this was a serious post and not a troll attempt 🤣