<\/p>\n
Kelp DAO says a LayerZero \u201cdefault\u201d single\u2011validator setup helped enable a $290m rsETH bridge hack, forcing a messy blame game and a rushed security migration.<\/p>\n
<\/p>\n
Kelp DAO has pushed back <\/a>against LayerZero\u2019s official explanation of a $290 million bridge exploit, arguing that the \u201csingle\u2011validator\u201d setup that let an attacker walk off with 116,500 rsETH was not reckless customization but a default configuration in LayerZero\u2019s own guidelines.<\/p>\n The liquidity re\u2011staking protocol told CoinDesk the 1\u2011of\u20111 Decentralized Verifier Network (DVN) used on its rsETH cross\u2011chain route \u201cfollowed LayerZero\u2019s documented defaults\u201d and that the validator stack compromised by the attacker \u201cis part of LayerZero\u2019s own infrastructure,\u201d rather than an unvetted third party.<\/p>\n The attack, which hit on April 18, minted or released 116,500 rsETH to an attacker\u2011controlled address \u2014 about 18% of the token\u2019s supply \u2014 and translated into losses of roughly $290\u2013$293 million at the time, making it the largest DeFi exploit of 2026 so far.<\/p>\n In its investigation report and follow\u2011up statements, LayerZero has insisted that \u201cLayerZero\u2019s protocol was not broken,\u201d arguing instead that Kelp DAO \u201cdeployed a single\u2011point\u2011of\u2011failure DVN in production\u201d for a token with more than $1 billion in total value locked.<\/p>\n The interoperability firm said \u201coperating a single\u2011point\u2011of\u2011failure configuration meant there was no independent verifier to catch and reject a forged message\u201d and claimed it had previously communicated \u201cbest practices around DVN diversification\u201d to Kelp DAO and other partners.<\/p>\n Security researchers and auditors, including SlowMist co\u2011founder Yu Xian, have confirmed that the rsETH bridge route used a 1\/1 DVN \u2014 effectively a single signature \u2014 rather than a 2\/2 or multi\u2011DVN stack, calling it a \u201csingle\u2011signature single point\u201d vulnerability that may have been aided by social engineering.<\/p>\n A detailed post\u2011mortem from DeFi tracking site DeFiPrime notes that LayerZero\u2019s OApp model lets applications choose how many DVNs must sign off on a message, with 2\u2011of\u20113 or 3\u2011of\u20115 configurations commonly recommended for high\u2011value deployments, but says Kelp\u2019s adapter \u201cwas configured to accept the attestation of a single verifier\u201d run by LayerZero Labs.<\/a><\/p>\n That design meant \u201cone forged signature was enough to make any cross\u2011chain message look real,\u201d allowing the attacker to feed the bridge a fake instruction that mimicked a valid message from another chain and triggered the release of 116,500 rsETH \u201cout of thin air\u201d to their wallet.<\/p>\n Kelp DAO\u2019s team counters that they implemented LayerZero\u2019s own public code and defaults across multiple networks and that the DVN exploited \u201cwas operated by LayerZero itself,\u201d implying that responsibility sits at least partly with the infrastructure provider rather than solely with the application.<\/p>\n <\/p>\n LayerZero has now taken the unusual step of promising it \u201cwill stop signing messages for any applications using a single\u2011validator setup\u201d and is forcing a \u201csecurity migration\u201d that will require all OApps to move to multi\u2011DVN architectures if they want to keep using the protocol.<\/p>\n The fallout goes well beyond one re\u2011staking token.<\/p>\n As crypto.news reported in an earlier story on the rsETH exploit and LayerZero\u2019s attribution of the attack to North Korea\u2019s Lazarus Group, the incident has reignited a broader debate over bridge design, default configurations and who ultimately bears responsibility when modular cross\u2011chain infrastructure goes wrong.<\/p>\n Related crypto.news stories you can link in copy include coverage of the Kelp DAO\u2013LayerZero exploit and Lazarus attribution, analysis of earlier cross\u2011chain bridge hacks, and reporting on how re\u2011staking and liquid\u2011staking protocols concentrate smart\u2011contract risk across multiple chains.<\/p>\n <\/p><\/div>\n","protected":false},"excerpt":{"rendered":" Kelp DAO says a LayerZero \u201cdefault\u201d single\u2011validator setup helped enable a $290m rsETH bridge hack, forcing a messy blame game and a rushed security migration. Summary Kelp DAO disputes LayerZero\u2019s…<\/p>\n","protected":false},"author":1,"featured_media":10096,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-26366","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=26366"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26366\/revisions"}],"predecessor-version":[{"id":26367,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26366\/revisions\/26367"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/10096"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=26366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=26366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=26366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Single\u2011validator blame game after rsETH exploit<\/h1>\n