LayerZero Price Forecast: ZRO extends decline as network links KelpDAO’s $290M hack to Lazarus Group

• LayerZero slips to $1.630 amid bearish momentum indicators, with the MACD maintaining a sell signal.
• LayerZero attributes the KelpDAO’s $290 million exploit to the Lazarus Group.
• LayerZero confirmed that the exploit incident is limited to the KelpDAO rsETH configuration and has not spread to other assets or applications.

LayerZero (ZRO) is grinding lower, trading at $1.630 at the time of writing on Tuesday, weighed down by a dominant risk-off mood following KelpDAO’s exploit on Saturday. The path of least resistance points downward, as momentum indicators signal a strong bearish grip. Meanwhile, immediate support lies in the $1.400–$1.600 range, where traders could re-enter with new positions.

LayerZero attributes KelpDAO’s $290M to the Lazarus Group

KelpDAO, a liquid restaking protocol backed by YZi Labs, was exploited on Saturday, resulting in a $290 million loss. KelpDAO said in a statement published on Monday that “rsETH was drained from the rsETH bridging adapter through a forged cross-chain message,” after the hackers compromised two Remote Procedure Call (RPC) nodes hosted by LayerZero.

“A simultaneous DDoS attack was launched against the third RPC node. This was an attack on LayerZero's infrastructure. Kelp's own systems were not involved in building or operating that infrastructure,” Kelp explained.

In response, Kelp paused relevant smart contracts on the Ethereum (ETH) mainnet and Layer2s (L2s), as well as blacklisted all the wallets associated with the hacker. The team also stopped another exploit attempt targeting 40,000 rsETH, worth approximately $95 million.

In a statement issued on Monday, LayerZero attributed the $290 million exploitation to the infamous Lazarus Group. The protocol added that the incident was isolated to KelpDAO’s rsETH configuration and that there was zero contagion to other assets or applications in the ecosystem.

“The affected application was rsETH, issued by KelpDAO. Their OApp configuration at the time of this incident relied on a 1-of-1 DVN setup, with LayerZero Labs as the sole verifier – a configuration that directly contradicts the multi-DVN redundancy model that LayerZero has consistently recommended to all integration partners,” LayerZero added.

Notably, the Arbitrum Security Council moved swiftly and froze 30,766 ETH, worth around $71, that the hacker was holding on the Arbitrum One platform, addresses connected to the KelpDAO exploit.

Technical outlook: LayerZero under pressure as technicals weaken

LayerZero trades at $1.630, extending a bearish bias as price holds well beneath the key exponential moving averages (EMAs). The 100-day EMA at $1.850, the 200-day EMA at $1.861 and the 50-day EMA at $1.900 are all clustered overhead , while a broader downward resistance trendline drawn from the March 18 high at $2.40 reinforces the perception of a market trading within a corrective phase.
Momentum indicators echo this soft tone, with the Relative Strength Index (RSI) hovering around 37 on the daily chart and the Moving Average Convergence Divergence (MACD) negative histogram, hinting that selling pressure still dominates despite the recent stabilization above $1.60.

On the topside, initial resistance lies at the 100-day EMA around $1.850, followed closely by the 200-day EMA at $1.861, forming a dense supply cluster that bulls would need to reclaim to ease downside pressure. A sustained break above that area would expose the 50-day EMA at $1.900, ahead of the broader descending trend line that continues to cap the larger recovery attempts. In the absence of clearly defined support levels, the grey-marked region on the chart between $1.400 and $1.600 is in line to absorb selling pressure.

(The technical analysis of this story was written with the help of an AI tool.)