Kelp DAO Disputes LayerZero's Claim of Liability in $290 Million Hack

A recent $290 million hack has led to a dispute between Kelp DAO and LayerZero, with Kelp planning to contest LayerZero's claim that it was responsible for the breach. According to a source familiar with the matter, Kelp will argue that the compromised verifier was part of LayerZero's own infrastructure and that the setup was based on LayerZero's default configuration. The hack occurred when attackers poisoned the servers that LayerZero's verifier relied on to check transactions, allowing them to drain 116,500 rsETH, worth about $290 million, from Kelp's LayerZero-powered bridge. Kelp claims that all of the infrastructure involved was built and run by LayerZero, not Kelp. The source also contested LayerZero's framing of the '1/1 configuration' as a fringe choice made against guidance, stating that LayerZero's own quickstart guide and default GitHub configuration point to a 1/1 DVN setup, which 40% of protocols on LayerZero are currently using. Security researchers have also questioned LayerZero's isolated framing, with one researcher noting that LayerZero's reference setup ships with single-source verification defaults across every major chain. Kelp has stated that it relied on LayerZero's documentation, defaults, and team guidance to make configuration decisions, and that it has operated on LayerZero infrastructure since January 2024 with close communication with the LayerZero team.