KelpDAO has publicly disputed claims made by LayerZero Labs concerning the April 18, 2026, exploit. Within the newest submit on X, it argued that the incident stemmed from failures inside LayerZero’s infrastructure relatively than any misconfiguration by itself platform.
In line with KelpDAO, attackers exploited LayerZero’s techniques, ensuing within the lack of greater than $300 million throughout a number of DeFi protocols. The staff additional revealed that two extra solid transactions value over $100 million have been efficiently signed and processed by LayerZero’s DVN earlier than being halted after Kelp intervened and paused its contracts.
KelpDAO Counters LayerZero Narrative
Kelp claimed that this early response prevented additional monetary harm, although the underlying bridging infrastructure remained energetic for a while after the difficulty had been detected and reported.
On the heart of the dispute is LayerZero’s assertion that the exploit resulted from a configuration situation particular to KelpDAO. Kelp rejected this clarification, whereas claiming that the configuration in query was broadly used throughout the LayerZero ecosystem and aligned with its official documentation.
Knowledge cited by Kelp signifies that a good portion of LayerZero purposes relied on comparable DVN setups, together with many working underneath a 1-1 configuration involving LayerZero’s personal DVN. This setup was neither distinctive nor experimental however a part of normal deployment practices adopted by quite a few protocols.
Kelp additionally defined that LayerZero’s DVN is a core element of its ecosystem and is included in default configurations supplied to builders. The corporate identified that LayerZero’s documentation and quickstart templates information builders towards these default setups, typically with out requiring extra DVNs. Kelp acknowledged that it adopted these pointers and maintained common communication with the LayerZero staff since integrating the infrastructure in early 2024. Throughout this era, Kelp added that its configuration selections have been reviewed and authorised, and there was no indication that the setup posed a safety danger.
Reviews cited by Kelp describe compromised off-chain techniques accountable for monitoring blockchain exercise, in addition to fraudulent attestations triggered by means of the DVN. Some researchers have detailed the occasion as a broader infrastructure breach relatively than a restricted RPC situation, which, once more, factors to compromised nodes and weaknesses inside LayerZero’s belief boundary.
In the meantime, LayerZero Labs admitted in its postmortem that attackers accessed RPC endpoints utilized by its DVN and took management of a number of nodes earlier than finishing up what it known as an RPC spoofing assault. Nevertheless, Kelp and unbiased analysts imagine that this description downplays the difficulty, as pretend messages have been nonetheless authorised regardless of safeguards.
Transition to Chainlink
KelpDAO applied speedy measures to safe its techniques in response. This included pausing contracts and conducting a full evaluation of its bridging infrastructure. As a part of its long-term technique, the protocol has introduced plans emigrate away from LayerZero’s OFT normal and undertake the Cross-Chain Interoperability Protocol (CCIP) developed by Chainlink.
This transition will transfer rsETH to Chainlink’s Cross-Chain Token normal. The protocol revealed that the purpose of this alteration is to cut back reliance on single factors of failure whereas strengthening cross-chain safety going ahead.
The submit After Disputing LayerZero Claims, KelpDAO Prepares Chainlink CCIP Migration appeared first on CryptoPotato.