The conflict over the Kelp DAO hack is heating up. The protocol is no longer buying into LayerZero's narrative that the attack was allegedly due to a misconfiguration on Kelp's part. Now, the team claims the opposite: the compromised setup was not an exception but rather a standard configuration that LayerZero itself used as a baseline.
This is a significant turning point. The story stops being just a breakdown of a single hack and transforms into a debate about who is responsible for architectural risk in the critical infrastructure of DeFi.
Kelp challenges LayerZero's key thesis.
After the attack, LayerZero essentially reduced the issue to Kelp DAO's choice. According to the infrastructure provider, the protocol used a scheme with a single verifier, even though it was supposedly advised to adopt a more robust setup with multiple verifying nodes.
Now, Kelp DAO is preparing a public response with an opposing logic. The team argues that they used exactly the configuration that LayerZero offered as standard upon connection. If that's the case, the question radically changes: it's not about the client ignoring recommendations, but about whether the foundational model itself could be vulnerable.
At the center of the dispute is the 1-of-1 configuration.
The key technical question is the 1-of-1 DVN scheme. This is a model in which a single verifier is sufficient to confirm a cross-chain message. This approach is simpler and faster, but it has an obvious weakness: a single point of compromise can lead to false transactions.
This is the very scheme that LayerZero is now criticizing in hindsight. But Kelp DAO insists that this configuration was neither marginal nor unusual. On the contrary, it adhered to documentation, standard examples, and, according to the team, was confirmed in working contacts with LayerZero as permissible.
Kelp claims that LayerZero's infrastructure was compromised.
Another critical point concerns the very object of the attack. According to Kelp DAO, the attackers did not hack an independent verifier chosen by the protocol at their own risk. The compromised verifier was one that operated on LayerZero's own infrastructure.
The team claims that the attackers gained access to two LayerZero servers used to validate the correctness of cross-chain messages. Then the backup nodes were overloaded with garbage traffic, causing the system to rely on the already infected elements. If this version is confirmed, pressure on LayerZero will only increase.
The dispute is not about a bug, but about accountability.
And this is what makes the situation particularly sensitive. We're not talking about a classic smart contract hack or a hack of Kelp DAO's private keys. The dispute revolves around who is responsible for the security of the configuration that the market perceived as functional and standard.
For DeFi, this is a painful issue. The ecosystem is often structured so that applications depend on infrastructure providers, documentation, ready-made templates, and recommended parameters. If the provider later claims that the configuration used was erroneous, an obvious trust crisis arises.
Researchers are also questioning LayerZero's position.
On Kelp DAO's side, some researchers are stepping in. They point out that in the public documentation and deployment examples, LayerZero did use schemes with a single verification source on major networks. This weakens the company's position, which after the hack tried to present 1-of-1 as a controversial choice made against recommendations.
The criticism here is straightforward. If the configuration is deemed unsafe, it shouldn't be default, shouldn't be supplied in examples, and shouldn't scale as a working option for new integrations. Otherwise, the responsibility can't rest solely on the protocol that utilized it.
The attack affected the bridge, not the core of Kelp.
Kelp DAO emphasizes that the main restaking protocol was not hacked. According to the team, the incident was confined to the bridge level, which operated on LayerZero infrastructure. This is an important detail for the market as it separates the core mechanics of rsETH from the cross-chain asset movement channel.
Furthermore, the team claims that the emergency stop of contracts 46 minutes after the attack helped prevent two more withdrawal attempts. Potentially, this saved about $200 million in rsETH that could have been withdrawn beyond the already stolen funds. In other words, the damage could have been even significantly higher.
LayerZero tightens its policy following the incident.
In light of the LayerZero scandal, they have already taken a drastic step. The company announced that it will no longer sign messages for applications using a single verifier configuration. This means forced migration for all protocols operating on such a model.
This decision in itself is telling. It essentially confirms that the architecture with a single verifier is no longer considered acceptable. But at the same time, it raises an uncomfortable question: if this scheme was indeed so vulnerable, why did it exist as a working standard for hundreds of millions of dollars before the hack?
For the market, this is a blow to the reputation of the entire cross-chain infrastructure.
The situation with Kelp and LayerZero is significant not just as a dispute between two parties. It impacts a broader segment — the cross-chain infrastructure on which an increasing number of DeFi protocols rely. If users and teams start doubting not only a specific app but also the foundational logic of bridges, the risks will quickly spread throughout the ecosystem.
This is especially risky in light of the recent issues with Aave and other related protocols. One hack has already triggered a cascading effect through collateral, liquidity, and hopeless debt. Now, a debate is brewing over whether we can even trust the standard setups of one of the biggest players in the infrastructure space.
What's next?
The further development depends on which version of events solidifies in the public domain. If the market accepts Kelp DAO's argument that the default infrastructure of LayerZero was vulnerable, it will deal a serious blow to the provider’s reputation and to the entire trust model regarding ready-made setups for cross-chain systems.
If LayerZero can prove that the protocol indeed deviated from recommendations or failed to implement necessary redundancy, the focus will shift back to the responsibility of the application itself. But one thing is clear: the dispute has gone far beyond a single hack. It touches on a fundamental DeFi question about where marketing-driven decentralization ends and real accountability for security architecture begins.
\u003ct-88/\u003e \u003ct-90/\u003e \u003ct-92/\u003e \u003ct-94/\u003e
\u003cc-6/\u003e
