LayerZero says Kelp setup caused exploit, as Aave loss questions mount
LayerZero said that Kelp’s DVN setup caused the $290 million exploit, as investors questioned which protocol would step up to cover the shortfall.
Interoperability protocol LayerZero claims that an inadequate setup tied to Kelp’s decentralized verifier network (DVN) enabled malicious actors to steal $290 million from Kelp DAO, adding that preliminary signs point to North Korea-linked threat actors.
An attacker drained about 116,500 Restaked ETH (rsETH), worth roughly $292-$293 million at the time, from Kelp DAO’s LayerZero-powered rsETH bridge on Saturday.
LayerZero said Monday that the exploit stemmed from a single point of failure in Kelp’s setup, which relied on a single LayerZero DVN as the only verified path, despite LayerZero previously advising them against this.