Kelp claims that LayerZero approved the setup it blamed for $292 million bridge hack
The $292M exploit, linked to North Korean hackers, led Kelp to migrate its rsETH off LayerZero’s “OFT” standard to Chainlink’s “CCIP.”
What to know:
- Kelp DAO claims LayerZero personnel approved the 1-of-1 verifier setup that LayerZero later blamed for the $292 million rsETH bridge hack.
- LayerZero’s postmortem contradicted Kelp, but data showed 47% of active LayerZero OApp contracts used a 1-of-1 DVN setup. LayerZero banned it post-hack.
- The $292 million exploit, linked to a North Korean hacker group, led Kelp to migrate its rsETH off LayerZero’s OFT standard to Chainlink’s Cross-Chain Interoperability Protocol (CCIP).
Kelp’s memo says LayerZero personnel reviewed its configurations for over 2.5 years and in eight integration discussions, without warning that a 1-of-1 setup posed a material security risk.
The memo, titled “Setting the Record Straight Around the LayerZero Bridge Hack,” includes screenshots of Telegram exchanges that document LayerZero’s awareness and lack of objection to Kelp’s verifier setup.
One screenshot shows a LayerZero team member saying: “No problem on using defaults either — just tagging [redacted] here since he mentioned you may have wanted to use a custom DVN setup for verifying messages, but will leave that to your team!” Kelp says the “defaults” referenced in the exchange were the 1-of-1 LayerZero Labs DVN configuration later cited by LayerZero as the application-level setup that enabled the exploit.
