Layerzero Labs issued a statement on the $290M rsETH exploit, blaming KelpDAO's single-DVN setup and claiming zero contagion. Chainlink's Zach Rynes countered that validator centralization was the root cause, escalating the accountability debate.
A $292M hack on Kelp DAO exploited a 1-of-1 LayerZero DVN config. An open-source AI tool had flagged opaque DVN settings and a single point of failure 12 days prior. The tool's developer reviews five hits and three misses.
A suspected exploit on Kelp DAO’s rsETH bridge moved about 116,500 rsETH, valued in the source at roughly $292 million. Aave was not hacked directly, but became a key pressure point after the stolen assets were used in borrowing activity.
Blockaid said a leaked StakeDAO deployer key was used to reconfigure LayerZero v2 OFT peers, enabling the attacker to mint more than 5.4 trillion vsdCRV on Arbitrum and swap the tokens for ETH.
More than 30 hours after Kelp DAO’s rsETH bridge exploit, responsibility and repayment remain disputed. Kelp DAO, LayerZero, and Aave have all stated their positions, but no final resolution has been reached.
After losing 116,500 rsETH in a LayerZero bridge hack on April 18, Kelp DAO is migrating $292 million worth of assets to Chainlink CCIP. LayerZero and Kelp trade blame over the vulnerability.
Kelp DAO said its rsETH bridge attack led to about $292 million in losses. The dispute with LayerZero centers on validator configuration, while Kelp DAO says it will move the bridge to Chainlink’s cross-chain protocol.
LayerZero has handled over $260 billion across 830+ omnichain tokens spanning 170+ blockchains. Projects like USDT0, Ondo, and institutions including PayPal and Fidelity leverage its security and compliance framework.
