Is DeFi Dead? Wintermute CEO Gaevoy Does Not See Innovation Prospects
Wintermute CEO Evgeny Gaevoy highlights risks hindering DeFi innovation.
U.Today1 min read
LayerZero says Kelp setup caused exploit, as Aave loss questions mount
TL;DR
LayerZero claims Kelp's inadequate setup allowed $290 million to be stolen by attackers, potentially linked to North Korea. The exploit occurred due to reliance on a single verification path in Kelp's decentralized verifier network.
Key points
- LayerZero claims Kelp's setup allowed a $290 million theft
- Attackers drained about 116,500 Restaked ETH from Kelp DAO
- The exploit was linked to a single verification path issue
- LayerZero advised Kelp DAO against a 1/1 DVN configuration
- Preliminary signs point to North Korea-linked threat actors
Mentioned in this story
LayerZeroKelp DAO
Restaked ETH
Interoperability protocol LayerZero claims that an inadequate setup tied to Kelp’s decentralized verifier network (DVN) enabled malicious actors to steal $290 million from Kelp DAO, adding that preliminary signs point to North Korea-linked threat actors.
An attacker drained about 116,500 Restaked ETH (rsETH), worth roughly $292-$293 million at the time, from Kelp DAO’s LayerZero-powered rsETH bridge on Saturday.
LayerZero said Monday that the exploit stemmed from a single point of failure in Kelp’s setup, which relied on a single LayerZero DVN as the only verified path, despite LayerZero previously advising them against this.
“LayerZero and other external parties previously communicated best practices around DVN diversification to KelpDAO. Despite these recommendations, KelpDAO chose to utilize a 1/1 DVN configuration.”
In practice, that meant Kelp relied on a single verification path for crosschain messages rather than requiring multiple independent checks.
The exploit quickly shifted attention from the technical cause to the question of who should absorb the losses, while the fallout spread into Aave, where the attacker used rsETH as collateral to borrow real liquidity.
Aave’s total value locked (TVL) has fallen by about $8.9 billion to $17.5 billion at the time of writing after the exploiter used the stolen funds to borrow on Aave, leaving about $195 million in “bad debt,” triggering withdrawals on the lending protocol.
Source: LayerZero
LayerZero said Kelp’s rsETH bridge relied solely on the LayerZero Labs DVN, and argued that the incident reflected an unsafe application configuration rather than a compromise of LayerZero itself. The company said it is now urging all applications using 1/1 DVN setups to migrate to multi-DVN configurations and will stop signing or attesting messages for apps that retain the single verifier design.
Q&A
What caused the $290 million exploit at Kelp DAO?
The exploit was caused by Kelp's reliance on a single verification path in its decentralized verifier network, which LayerZero had previously advised against.
Who is suspected to be behind the Kelp DAO attack?
Preliminary investigations suggest that North Korea-linked threat actors may be responsible for the Kelp DAO attack.
How much Ethereum was stolen in the Kelp DAO exploit?
Approximately 116,500 Restaked ETH, worth around $290 million, was drained from Kelp DAO during the exploit.
What recommendations did LayerZero provide to Kelp DAO?
LayerZero recommended diversifying the decentralized verifier network to avoid a single point of failure, which Kelp DAO did not implement.
