DeFi protocol Kelp DAO said it will be migrating its restaking token, rsETH, to the Chainlink oracle platform after the $292 million exploit in April, as it continued to blame the attack on LayerZero’s cross-chain infrastructure.
Hackers stole 116,500 Kelp DAO restaked ETH tokens on April 18 from Kelp DAO’s LayerZero-powered bridge, then used them as collateral on Aave v3 to borrow wrapped Ether.
“After the recent LayerZero exploit, we are taking steps to ensure rsETH is fully secure, which is why we are migrating to Chainlink CCIP,” Kelp DAO said in an X post on Tuesday.
Source: Kelp DAO
The Kelp DAO hack has been one of the year’s largest security incidents, causing broader ecosystem contagion and impacting the interconnected crypto lending market. At the center of the exploit has been an argument over who was responsible for the vulnerability.
Kelp says it wasn’t warned of the security risks
A day after the exploit, LayerZero released a postmortem arguing the hack occurred because of an inadequate setup tied to Kelp’s decentralized verifier network (DVN), which relied on a single LayerZero DVN as the only verified path rather than requiring multiple independent checks to validate cross-chain transactions. LayerZero said it advised against this setup.
However, Kelp DAO said Tuesday the 1-1 setup is the default and is used by many other protocols, citing data from analytics platform Dune that found roughly half of LayerZero users have a single DVN. It also accused LayerZero of approving the setup and failing to warn about the related security risk.
“Kelp has operated on LayerZero infrastructure since January 2024 and has maintained an open communication channel with the LayerZero team throughout. The question of DVN configuration came up multiple times and these configurations were confirmed as secure at that time,” Kelp DAO added.
Following the hack, LayerZero announced it will no longer validate or approve cross-chain messages for any app that relies on a single verifier, and that it is in the process of migrating protocols using the setup to a multi-DVN.
LayerZero CEO says many of the claims are untrue
Bryan Pellegrino, co-founder and CEO of LayerZero, said in a reply on X that a “ton” of Kelp’s claims were “just completely untrue.”
Related: US law firm attempts to block transfer of frozen ETH from Kelp exploit
He argued that Kelp originally used the defaults, which were multi-DVN, and later manually changed to a 1/1 configuration, which isn’t recommended for production applications.
“The defaults Kelp is referencing in their screenshot were multiDVN or DeadDVN, which force-rejects an application using the defaults at all and requires them to manually set configuration. rsETH was originally configured to use the default LayerZero configuration of a multiDVN setup of LayerZero Labs + Google,” he added.
Source: Bryan Pellegrino
Pellegrino also said a complete postmortem by external security firms would be published soon.
North Korea-linked hackers are suspected of being behind the attack on Kelp and the April 1 exploit of decentralized exchange Drift, which totaled $285 million.
Magazine: Bitcoiners eye ‘sell in May,’ SBF’s bid for new trial shut down: Hodler’s Digest, April 26 – May 2
