KelpDAO has issued a blistering response to Layerzero Labs following an April 18 exploit that drained more than $300 million in DeFi assets, primarily in the form of rsETH. In a public statement that contradicts Layerzero’s official post-mortem, KelpDAO alleges the bridge provider is “blaming users” for a systemic failure in its own core infrastructure.

The exploit, which has been linked with high confidence to the Lazarus Group, resulted in the fraudulent minting and release of assets. While KelpDAO managed to block an additional $100 million in forged transactions by pausing contracts, the fallout has triggered a massive shift in the DeFi landscape. KelpDAO subsequently announced an immediate migration to Chainlink CCIP.

The central dispute lies in the cause of the breach. Layerzero’s post-mortem framed the incident as a “KelpDAO configuration issue,” specifically targeting Kelp’s use of a 1-of-1 decentralized verifier network (DVN) setup where Layerzero Labs was the sole validator. However, KelpDAO has fired back, citing Dune analysis showing that 47% of Layerzero OApp contracts—more than 1,200 applications—utilize the same 1-1 DVN “security floor.”

Kelp points out that Layerzero’s own OFT quickstart guide and default templates recommend the 1-1 setup with Layerzero Labs as the sole required DVN. The project also shared screenshots of Telegram conversations purportedly showing Layerzero team members assuring Kelp that “defaults were fine” during eight separate integration discussions over two years.

In a post on X setting the record straight, Kelp broke down what Layerzero admits to and what it conveniently ignores in its post-mortem. According to the post, Layerzero admitted that attackers gained access to the list of RPCs its DVN uses and confirmed that two independent nodes were compromised and binaries were swapped. Furthermore, Kelp cites Layerzero’s banning of 1-1 configurations after the $300 million loss as another form of admission.

However, according to Kelp, the post-mortem ignored that Layerzero’s own documentation pushed developers toward the vulnerable 1-1 setup. It also fails to explain why Layerzero’s monitoring systems failed to detect the hack, leaving Kelp to flag the issue.

“The simple truth: LayerZero blamed their users for an issue that was caused by their own infrastructure failure,” KelpDAO asserted in the post.

To support its conclusion, Kelp cited independent reviews that surfaced several critical vulnerabilities allegedly present at the time of the attack. These include findings that the default deployment exposed public gateways stripped of common security measures like WAF or IP allowlists. A review by Chainalysis determined that Layerzero set a low 1-1 RPC quorum default, meaning if one node was poisoned, the DVN signed the forged message without cross-checking others.

To demonstrate its loss of confidence in Layerzero, Kelp said it is transitioning rsETH from the Layerzero OFT standard to Chainlink’s Cross-Chain Token (CCT) standard.

“Our number-one priority remains the security of our users’ assets,” KelpDAO noted, citing Chainlink’s seven-year track record and its secure decentralized oracle network.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。