Kelp DAO Disputes LayerZero's Claim of Responsibility for $290 Million Disaster

A recent cryptocurrency exploit has sparked a heated debate between Kelp DAO and LayerZero, with each party blaming the other for the massive $290 million loss. The incident occurred when attackers drained 116,500 rsETH, worth approximately $290 million, from Kelp's LayerZero-powered bridge by compromising the servers that LayerZero's verifier relied on. Kelp DAO claims that the compromised verifier was part of LayerZero's own infrastructure and that the setup used was LayerZero's default configuration. According to Kelp, LayerZero's own quickstart guide and GitHub configuration recommend a 1/1 DVN setup, which is the same configuration used by 40% of protocols on LayerZero. Security researchers have also questioned LayerZero's framing of the incident, with some accusing the company of deflecting responsibility. LayerZero has since announced that it will no longer support single-verifier setups, forcing a protocol-wide migration. The incident has raised concerns about the security of cryptocurrency bridges and the potential for exploits. Kelp DAO has stated that it will work with LayerZero to establish a shared understanding of the incident and implement fixes to prevent similar incidents in the future.