Kelp DAO Disputes LayerZero's Account of $290 Million Exploit, Citing Default Settings as the Cause

A recent crypto controversy has emerged, with Kelp DAO set to challenge LayerZero's post-exploit analysis, which attributed blame to Kelp for the $290 million disaster. According to a source familiar with the matter, Kelp will argue that the compromised verifier was actually part of LayerZero's own infrastructure and that the setup in question was based on LayerZero's default onboarding configuration. Kelp, a liquid restaking protocol, takes user-deposited ether and issues a receipt token, rsETH, after routing it through a yield-generating system. LayerZero provides the cross-chain messaging infrastructure for moving rsETH between blockchains, using decentralized verifier networks to verify transactions. On Saturday, attackers exploited Kelp's LayerZero-powered bridge, draining 116,500 rsETH, worth approximately $290 million, by compromising LayerZero's servers. Kelp claims that the compromised servers were part of LayerZero's own infrastructure, not a third-party verifier, and that the attack was a sophisticated state-sponsored attack. The source also contested LayerZero's claim that Kelp chose a 1-of-1 DVN setup despite recommendations to configure multi-DVN redundancy, stating that LayerZero's own quickstart guide and default GitHub configuration point to a 1/1 DVN setup. Security researchers have also questioned LayerZero's account, with Yearn Finance core team developer Artem K stating that LayerZero's reference setup ships with single-source verification defaults across every major chain. Chainlink community manager Zach Rynes accused LayerZero of deflecting responsibility for its own compromised infrastructure. In response, LayerZero has said it will no longer sign messages for any application running a single-verifier setup, forcing a protocol-wide migration. Kelp DAO has confirmed that the 1-of-1 DVN setup reflects LayerZero's documented default configuration and has operated on LayerZero infrastructure since January 2024, maintaining close communication with the LayerZero team.