Kelp DAO loses $292 million in rsETH bridge attack

In an incident involving the Kelp DAO rsETH bridge, $292 million worth of cryptocurrency was withdrawn due to a security breach. This event has sparked a wave of mutual accusations between Kelp DAO and LayerZero over who was responsible for the vulnerability. While LayerZero argued that Kelp DAO’s use of a single validator setup created the risk, Kelp DAO countered by claiming that LayerZero’s team had approved this configuration, igniting a heated debate in the crypto community.

Approval dispute and internal communications

LayerZero is recognized in the crypto ecosystem as a platform that develops infrastructure enabling cross-chain communication for decentralized applications. On the other hand, Kelp DAO operates as a decentralized autonomous organization managing an Ethereum-based rsETH bridge. According to new documentation released by Kelp DAO, the LayerZero team reviewed Kelp’s one-to-one validator setup over two and a half years across eight separate integration meetings, yet never raised security concerns. Shared screenshots suggest that the LayerZero team left the decision on validator configuration up to Kelp and implied that switching to a private validator was not mandatory. However, it remains unclear whether these messages have been independently verified.

Kelp DAO further highlighted that LayerZero’s official bug bounty documentation expressly excludes misconfigurations on the application side from eligibility and noted that the majority of official examples demonstrate the single validator (DVN) model.

How the hack unfolded

On April 16, hackers believed to be linked to the North Korea-based Lazarus Group exploited a vulnerability in the LayerZero ecosystem and withdrew 116,500 rsETH. The attackers compromised two RPC servers in the LayerZero Labs validator network, installed malicious software, and then launched a DDoS attack on the remaining nodes, redirecting protocol operations to fake nodes. According to LayerZero, this resulted in approvals for transactions that never actually occurred. The breach led to the withdrawal of a total of $292 million from Kelp DAO, with two additional fraudulent transactions exceeding $100 million in volume each.

Following the attack, the LayerZero team stated, “The protocol functioned exactly as designed, and applications using the one-to-one validator model will no longer be eligible to sign.”

Data from Dune Analytics shows that, so far, nearly 47% of approximately 2,665 LayerZero OApp contracts were configured with one-to-one validators within the past 90 days, putting a total of $4.5 billion in assets at similar risk.

Reactions and recent developments

In a statement prepared by Kelp DAO, it was emphasized that the security loophole went unnoticed by LayerZero and was instead discovered by Kelp DAO itself, raising questions about the integrity of LayerZero’s monitoring systems. The statement also alleged a significant overlap at the administrator level between two different validator networks. On several blockchains, the LayerZero Labs validator network still operates as the sole authority.

Following the incident, Kelp DAO announced plans to migrate its rsETH bridge from LayerZero infrastructure to Chainlink’s cross-chain protocol. With this transition, rsETH will fully adopt Chainlink’s architecture and phase out LayerZero standards.

The scale of the attack and the ensuing dispute over responsibility have reverberated across the crypto sector. While both parties continue to accuse each other, LayerZero officials have refrained from making any public statements regarding the matter.