Key Takeaways
- Lazarus Group stole $300 million in rsETH on April 18 after breaching Layerzero’s core infrastructure.
- Over 47% of Layerzero OApps used the 1-1 DVN setup that the provider previously verified as secure.
- KelpDAO is migrating rsETH to Chainlink CCIP and the CCT standard to enhance cross-chain security.
The Dispute Over Network Configuration
KelpDAO has issued a blistering response to Layerzero Labs following an April 18 exploit that drained more than $300 million in DeFi assets, primarily in the form of rsETH. In a public statement that contradicts Layerzero’s official post-mortem, KelpDAO alleges the bridge provider is “blaming users” for a systemic failure in its own core infrastructure.
The exploit, which has been linked with high confidence to the Lazarus Group, resulted in the fraudulent minting and release of assets. While KelpDAO managed to block an additional $100 million in forged transactions by pausing contracts, the fallout has triggered a massive shift in the DeFi landscape. KelpDAO subsequently announced an immediate migration to Chainlink CCIP.
The central dispute lies in the cause of the breach. Layerzero’s post-mortem framed the incident as a “KelpDAO configuration issue,” specifically targeting Kelp’s use of a 1-of-1 decentralized verifier network (DVN) setup where Layerzero Labs was the sole validator. However, KelpDAO has fired back, citing Dune analysis showing that 47% of Layerzero OApp contracts—more than 1,200 applications—utilize the same 1-1 DVN “security floor.”
Kelp points out that Layerzero’s own OFT quickstart guide and default templates recommend the 1-1 setup with Layerzero Labs as the sole required DVN. The project also shared screenshots of Telegram conversations purportedly showing Layerzero team members assuring Kelp that “defaults were fine” during eight separate integration discussions over two years.
In a post on X setting the record straight, Kelp broke down what Layerzero admits to and what it conveniently ignores in its post-mortem. According to the post, Layerzero admitted that attackers gained access to the list of RPCs its DVN uses and confirmed that two independent nodes were compromised and binaries were swapped. Furthermore, Kelp cites Layerzero’s banning of 1-1 configurations after the $300 million loss as another form of admission.
However, according to Kelp, the post-mortem ignored that Layerzero’s own documentation pushed developers toward the vulnerable 1-1 setup. It also fails to explain why Layerzero’s monitoring systems failed to detect the hack, leaving Kelp to flag the issue.
“The simple truth: LayerZero blamed their users for an issue that was caused by their own infrastructure failure,” KelpDAO asserted in the post.
To support its conclusion, Kelp cited independent reviews that surfaced several critical vulnerabilities allegedly present at the time of the attack. These include findings that the default deployment exposed public gateways stripped of common security measures like WAF or IP allowlists. A review by Chainalysis determined that Layerzero set a low 1-1 RPC quorum default, meaning if one node was poisoned, the DVN signed the forged message without cross-checking others.
To demonstrate its loss of confidence in Layerzero, Kelp said it is transitioning rsETH from the Layerzero OFT standard to Chainlink’s Cross-Chain Token (CCT) standard.
“Our number-one priority remains the security of our users’ assets,” KelpDAO noted, citing Chainlink’s seven-year track record and its secure decentralized oracle network.
