KelpDAO Escalates Dispute with LayerZero Over $292M Exploit

KelpDAO has experienced one of DeFi's largest cross-chain security failures this year after a $292 million rsETH exploit on LayerZero's infrastructure. The protocol claims that LayerZero approved the bridge configuration later blamed for the hack, escalating a dispute over responsibility.

The exploit occurred on April 18 and drained about 116,500 rsETH from KelpDAO's LayerZero bridge. According to Chainalysis, the attack was not a smart contract hack but an attack on off-chain infrastructure in which attackers compromised internal RPC nodes and used false data to trick a 1 of 1 DVN setup into releasing funds against a nonexistent burn.

KelpDAO pushed back on LayerZero's framing of the incident, stating that the 1 of 1 setup was not unique to Kelp and was widely used across LayerZero integrations. The protocol also said it stopped additional damage by pausing contracts after detecting the exploit.