Kelp Blames LayerZero for $292 Million Hack, Plans Switch to Chainlink

In brief

• Kelp says LayerZero approved the setup tied to a $292 million exploit, which LayerZero disputes.
• The protocol is redesigning its cross-chain system after the hack.
• A U.S. court fight over $71 million in frozen funds could shape DeFi recovery rules.

KelpDAO is blaming LayerZero for a $292 million exploit and plans to relaunch with a redesigned cross-chain system on Chainlink, the group announced on X on Tuesday.

“From the April 18 incident, it is clear that LayerZero's own infrastructure was exploited, resulting in $300M in losses across DeFi,” Kelp DAO wrote on X. “Independent reports from SEAL 911, Chainalysis, and other major leading security researchers all point to the same origin.”

In April, an attack drained about 116,500 rsETH—an Ethereum-based staking token—from a cross-chain bridge used by Kelp, a protocol that lets users stake Ethereum and move tokens between blockchains. The exploit has been linked to North Korea’s Lazarus Group.

In a separate post on X, Kelp said LayerZero personnel approved the configuration tied to the exploit and did not warn that it posed a security risk. The setup, known as a 1-of-1 verifier, relies on a single entity to validate cross-chain transactions.

Kelp said the attack stemmed from a breach of LayerZero’s infrastructure, where attackers compromised the verifier network’s RPC nodes and forced the system to rely on tampered data, allowing fake transactions to be approved.

“After the exploit, LayerZero announced it would no longer sign or attest messages for any application using a 1-1 DVN configuration,” Kelp wrote. “That policy shift, made after hundreds of millions of dollars were exploited, confirms that this was a widely used LayerZero configuration that LayerZero Labs only changed after it failed.”

In an April statement, LayerZero disputed that account, saying the exploit was isolated to Kelp’s rsETH application and resulted from its use of a single-verifier setup that went against the company’s recommended multi-verifier model.