Kelp DAO 聲稱 LayerZero 的「預設」設定才是導致這場 2.9 億美元重大災難的真正原因

📄完整原文· 由 trafilatura 自動擷取6350 字

Kelp DAO claims LayerZero’s 'default' settings are what actually caused the massive $290 million disaster The liquid restaking protocol said the compromised verifier was LayerZero's own infrastructure, and the setup it was faulted for running was LayerZero's onboarding default. What to know: - Kelp DAO is disputing LayerZero's account of a $290 million rsETH bridge exploit, claiming that the compromised single-verifier setup relied on LayerZero’s own infrastructure and defaults rather than an outlier configuration it chose against advice. - Some security researchers say LayerZero’s public documentation and deployment code promote single-source verification across major chains, undercutting the firm’s claim that Kelp ignored guidance to adopt multi-verifier redundancy. - Kelp claims the attack was limited to the LayerZero-powered bridge and not its core restaking contracts, while LayerZero has responded by vowing to stop signing messages for any application using a single-verifier setup, forcing a broad migration. The popular Spiderman meme showing three identical superheroes pointing fingers at each other is having its crypto moment today. Kelp DAO is set to push back on LayerZero's post-mortem of Sunday’s $290 million exploit, which essentially blames Kelp, a L2 source familiar with the matter told CoinDesk. Kelp plans to dispute the cross-chain messaging firm's claim that it ignored repeated warnings to move away from a single-verifier setup. CoinDesk has reviewed and verified the memo Kelp plans to publish. Kelp is a liquid restaking protocol that takes user-deposited ether, routes it through a yield-generating system called EigenLayer, and issues a receipt token, rsETH, in exchange. LayerZero is the cross-chain messaging infrastructure that moves rsETH between blockchains, using entities called DVNs (decentralized verifier networks) to verify whether a cross-chain transfer is valid. On Saturday, attackers drained 116,500 rsETH, worth about $290 million, from Kelp's LayerZero-powered bridge by poisoning the servers that LayerZero's verifier relied on to check transactions. Kelp, the source said, is planning on saying the DVN that was compromised via what it calls a "sophisticated state-sponsored attack” was LayerZero's own infrastructure, not a third-party verifier. Attackers compromised two of LayerZero's own servers that check whether cross-chain transactions are legitimate, then flooded the backup servers with junk traffic to force LayerZero's verifier onto the compromised ones. All of that infrastructure was built and run by LayerZero, not Kelp, the source claimed. The source contested LayerZero's framing of the "1/1 configuration" as a fringe choice made against guidance. LayerZero's post-mortem said KelpDAO chose a 1-of-1 DVN setup despite expressing recommendations to configure multi-DVN redundancy. A "1/1 configuration" means only a single validator must sign off on a cross-chain message for the bridge to act on it, leaving the system with no second check to catch a compromised or forged instruction. A multi-validator configuration (such as 2/3, 3/5, etc.) ensures there is no single point of failure that can approve a forged message on its own. They added that, through a direct communications channel with LayerZero, which has been open since July 2024, they produced no specific recommendation for Kelp to change the rsETH DVN configuration. LayerZero's own quickstart guide and default GitHub configuration point to a 1/1 DVN setup, the source told CoinDesk, adding 40% of protocols on LayerZero are currently using the same configuration. The configuration Kelp ran also appears in LayerZero's own V2 OApp Quickstart, where the sample layerzero.config.ts wires every pathway with one required DVN and no optional DVNs. That’s the same 1/1 structure. Kelp's core restaking contracts were not touched, and the exploit was isolated to the bridge layer, they added. Its emergency pause, 46 minutes after the drain, blocked two follow-up attempts that would have released an additional ~$200 million in rsETH. CoinDesk reached out to LayerZero for comment on the story and didn't hear back by the time of publication. 'Deflecting responsibility' Security researchers are also not buying LayerZero's isolated framing, which pinned the blame on Kelp. Kelp is a liquid restaking protocol. Its core competency is staking infrastructure, EigenLayer integration, and liquid staking token management. When integrating with LayerZero, Kelp relied on LayerZero's documentation, their defaults, and their team's guidance to make configuration decisions, the source claimed. Yearn Finance core team developer Artem K, who is popularly known as @banteg on X, posted a technical review of LayerZero's public deployment code and said that the reference setup ships with single-source verification defaults across every major chain, including Ethereum, BSC, Polygon, Arbitrum and Optimism. That deployment also leaves a public endpoint exposed that leaks the list of configured servers to anyone who queries it. Banteg flagged in his analysis that he can't prove which configuration Kelp used, but noted that LayerZero usually asks new operators to use its default setup, which its post-mortem criticized. Chainlink community manager Zach Rynes put it bluntly on X, alleging that LayerZero was "deflecting responsibility" for its own compromised infrastructure and accused the company of throwing Kelp under the bus for trusting a setup LayerZero itself supported. As such, LayerZero has said it will no longer sign messages for any application running a single-verifier setup, forcing a protocol-wide migration. Read more: 'DeFi is dead': crypto community scrambles after this year's biggest hack exposes contagion risk More For You LayerZero said the attackers compromised two RPC nodes the company's verifier relied on and DDoS'd the rest, with the attack working only because Kelp had ignored multi-verifier recommendations. What to know: - LayerZero blamed the $290 million Kelp DAO exploit on Kelp's decision to use a single-verifier configuration, despite prior warnings to adopt a multi-verifier setup. - Attackers, whom LayerZero preliminarily linked to North Korea's Lazarus Group, compromised two RPC nodes and used a DDoS attack to force failover, tricking LayerZero's verifier into...

資料狀態✓ 已擷取全文閱讀原文（CoinDesk）

🔍歷史類似事件· 關鍵字 + 標的比對6 則

2026-04-21

2.9 億美元竊案誰扛責？Kelp DAO 甩鍋嗆：LayerZero「預設配置」害的

相似度 180%關鍵字 dao/layerzero/kelp

2026-04-21

Arbitrum 凍結了與 Kelp DAO 漏洞攻擊相關的 7100 萬美元 ETH

相似度 180%關鍵字 dao/million/kelp

2026-04-20

在 Kelp DAO 橋接漏洞引發 DeFi 混亂後，Aave 可能面臨高達 2.3 億美元的損失

相似度 180%關鍵字 dao/million/kelp

2026-04-20

LayerZero 表示 Kelp 的設定導致了漏洞利用，Aave 的損失疑慮隨之增加

相似度 180%關鍵字 caused/layerzero/kelp

2026-04-20

LayerZero 將 2.9 億美元的漏洞攻擊歸咎於 Kelp 的設定，並將其歸因於北韓的 Lazarus

相似度 180%關鍵字 million/layerzero/kelp

2026-04-19

2.92 億美元的 Kelp 漏洞攻擊事件：發生經過及其對 DeFi 的意義

相似度 180%關鍵字 what/million/kelp

💡 目前用關鍵字 + 標的比對（MVP）· 之後會升級為 embedding 語意搜尋

原始資訊

ID：56bedac466

來源：CoinDesk

發佈：2026-04-20 13:41:02

分類：一般 · 導出分類 neutral

標的：未指定

社群投票：+0 / −0 · ⭐ 0 重要 · 💬 0 留言