{"id":77709,"date":"2026-05-06T09:06:30","date_gmt":"2026-05-06T02:06:30","guid":{"rendered":"https:\/\/hbbgroup.net\/kelp-blames-layerzero-for-292-million-hack-plans-switch-to-chainlink\/"},"modified":"2026-05-06T09:06:30","modified_gmt":"2026-05-06T02:06:30","slug":"kelp-blames-layerzero-for-292-million-hack-plans-switch-to-chainlink","status":"publish","type":"post","link":"https:\/\/hbbgroup.net\/zh\/kelp-blames-layerzero-for-292-million-hack-plans-switch-to-chainlink\/","title":{"rendered":"Kelp Blames LayerZero for $292 Million Hack, Plans Switch to Chainlink"},"content":{"rendered":"<div>\n<div>\n<h4 color=\"#333\">In brief<\/h4>\n<ul>\n<li>Kelp says LayerZero approved the setup tied to a $292 million exploit, which LayerZero disputes.<\/li>\n<li>The protocol is redesigning its cross-chain system after the hack.<\/li>\n<li>A U.S. court fight over $71 million in frozen funds could shape DeFi recovery rules.<\/li>\n<\/ul>\n<\/div>\n<p>KelpDAO is blaming LayerZero for a <a href=\"https:\/\/decrypt.co\/364981\/arbitrum-security-council-freezes-71-5m-in-ethereum-linked-to-292m-kelpdao-exploit\" target=\"_blank\" rel=\"noopener\">$292 million<\/a> exploit and plans to relaunch with a redesigned cross-chain system on <a href=\"https:\/\/decrypt.co\/resources\/what-is-chainlink\" target=\"_blank\" rel=\"noopener\">Chainlink<\/a>, the group announced on X on Tuesday.<\/p>\n<p>\u201cFrom the April 18 incident, it is clear that LayerZero&#8217;s own infrastructure was exploited, resulting in $300M in losses across DeFi,\u201d Kelp DAO <a href=\"https:\/\/x.com\/KelpDAO\/status\/2051755467328913637?s=20\" target=\"_blank\" rel=\"noopener nofollow external\">wrote<\/a> on X. \u201cIndependent reports from SEAL 911, Chainalysis, and other major leading security researchers all point to the same origin.\u201d<\/p>\n<p>In April, an attack drained about <a href=\"https:\/\/decrypt.co\/364849\/kelp-dao-exploit-aave-liquidity-crunch-6-2-billion-withdrawal-panic\" target=\"_blank\" rel=\"noopener\">116,500<\/a> rsETH\u2014an Ethereum-based staking token\u2014from a cross-chain bridge used by Kelp, a protocol that lets users stake Ethereum and move tokens between blockchains. The exploit has been linked to North Korea\u2019s Lazarus Group.<\/p>\n<p>In a separate <a href=\"https:\/\/x.com\/KelpDAO\/status\/2051754226351771772?s=20\" target=\"_blank\" rel=\"noopener nofollow external\">post<\/a> on X, Kelp said LayerZero personnel approved the configuration tied to the exploit and did not warn that it posed a security risk. The setup, known as a 1-of-1 verifier, relies on a single entity to validate cross-chain transactions.<\/p>\n<p>Kelp said the attack stemmed from a breach of LayerZero\u2019s infrastructure, where attackers compromised the verifier network\u2019s RPC nodes and forced the system to rely on tampered data, allowing fake transactions to be approved.<\/p>\n<p>\u201cAfter the exploit, LayerZero announced it would no longer sign or attest messages for any application using a 1-1 DVN configuration,\u201d Kelp wrote. \u201cThat policy shift, made after hundreds of millions of dollars were exploited, confirms that this was a widely used LayerZero configuration that LayerZero Labs only changed after it failed.\u201d<\/p>\n<p>In an April <a href=\"https:\/\/layerzero.network\/blog\/kelpdao-incident-statement\" target=\"_blank\" rel=\"noopener nofollow external\">statement<\/a>, LayerZero disputed that account, saying the exploit was isolated to Kelp\u2019s rsETH application and resulted from its use of a single-verifier setup that went against the company\u2019s recommended multi-verifier model.<\/p>\n<p>\u201cThat framing does not match the facts,\u201d Kelp DAO wrote. \u201cIt is a matter of public domain that this 1-1 setup was not unique to Kelp.\u201d<\/p>\n<p>According to Kelp, it followed LayerZero\u2019s documentation and default configurations. The company also said the setup was widely used across the ecosystem, pointing to data showing a large share of applications relied on similar configurations.<\/p>\n<p>Kelp said it is moving its<a href=\"https:\/\/decrypt.co\/price\/kelp-dao-restaked-eth\" target=\"_blank\" rel=\"noopener\"> rsETH<\/a> system to Chainlink\u2019s cross-chain interoperability protocol, where transactions must be approved by multiple independent validators instead of a single verifier.<\/p>\n<p>&#8220;We&#8217;re committed to working with the KelpDAO team on improving the cross-chain security of rsETH and supporting their migration to Chainlink CCIP,&#8221; Chainlink Chief Business Officer Johann Eid told <i>Decrypt<\/i>. &#8220;We have long believed that in order for DeFi to reach its full potential of bringing trillions onchain, the ecosystem needs to be underpinned by highly secure infrastructure.&#8221;<\/p>\n<p>The impact of the exploit of Kelp has extended beyond the technical dispute. About $71 million in crypto linked to the exploit was frozen on the Arbitrum network, triggering a <a href=\"https:\/\/decrypt.co\/366744\/aave-unfreeze-71m-arbitrum-kelp-dao-hack\" target=\"_blank\" rel=\"noopener\">legal fight<\/a> in a New York federal court.<\/p>\n<p>\u201cThere are questions that the ecosystem deserves answers to,\u201d Kelp DAO wrote. \u201cAnd we are ensuring rsETH is secured by infrastructure that doesn&#8217;t leave these questions open.\u201d<\/p>\n<p>LayerZero did not immediately respond to a request for comment by <i>Decrypt.<\/i><\/p>\n<div>\n<h3>Daily Debrief Newsletter<\/h3>\n<p>Start every day with the top news stories right now, plus original features, a podcast, videos and more.<\/p>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>In brief Kelp says LayerZero approved the setup tied to a $292 million exploit, which LayerZero disputes. The protocol is [&hellip;]<\/p>","protected":false},"author":5,"featured_media":77711,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[220],"tags":[],"class_list":["post-77709","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tien-dien-tu"],"acf":[],"_links":{"self":[{"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/posts\/77709","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/comments?post=77709"}],"version-history":[{"count":0,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/posts\/77709\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/media\/77711"}],"wp:attachment":[{"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/media?parent=77709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/categories?post=77709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hbbgroup.net\/zh\/wp-json\/wp\/v2\/tags?post=77709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}