Kelp DAO Claims LayerZero Approved the Setup It Blamed for $292 Million Hack, Migrates to Chainlink

Kelp DAO published a detailed memo on Wednesday claiming that LayerZero personnel directly approved the bridge configuration that LayerZero subsequently blamed for the $292 million rsETH exploit. The accusation escalates a dispute over responsibility for one of DeFi’s largest cross-chain security failures this year.

LayerZero’s April 19 postmortem said Kelp’s rsETH application relied on LayerZero Labs as its sole verifier, a configuration it described as directly contradicting its recommended multi-DVN model. Kelp disputes that framing.

This story is an excerpt from the Unchained Daily newsletter.

The memo says the 1-of-1 DVN setup was reviewed across eight integration meetings over approximately two and a half years, and that LayerZero personnel never flagged the configuration as a serious security risk. Kelp also pointed to LayerZero’s own documentation, which listed single-DVN configurations in its V2 OApp Quickstart guide and excluded application-level verifier choices from its bug bounty scope.

Data from Dune Analytics backs Kelp’s claim that the setup was not an outlier. Roughly 47% of approximately 2,665 active LayerZero OApp contracts used a 1-of-1 DVN setup within the past 90 days, putting an estimated $4.5 billion at risk across the ecosystem.

LayerZero responded in a statement to CoinDesk, saying Kelp “deployed multiDVN and then manually downgraded to a 1/1.” The company also said its protocol defaults “across almost all pathways are multi-DVN” and that cases where templates show a 1-of-1 configuration point to a “DeadDVN” contract designed to prompt developers to configure their own security stack before going live.

On-chain researcher Banteg noted he could not prove which configuration Kelp originally deployed but observed that LayerZero’s default setup was the same one its postmortem criticized. Chainlink community manager Zach Rynes accused LayerZero of “deflecting responsibility” for its own compromised infrastructure.

Kelp announced it is migrating rsETH from LayerZero’s OFT standard to Chainlink’s Cross-Chain Interoperability Protocol (CCIP). Chainlink Chief Business Officer Johann Eid said the company is “committed to working with the KelpDAO team on improving the cross-chain security of rsETH.” CCIP’s architecture requires multiple independent oracle networks to approve transfers rather than relying on a single verifier.

The migration adds another layer to the ongoing legal battle over $71 million in exploit-linked ETH frozen on Arbitrum, where North Korea terrorism creditors and the DeFi United recovery coalition are competing for control of the funds in a U.S. federal court.