LayerZero Under Fire: Industry Questions Response to $290M Hack

LayerZero is currently in the spotlight following a significant breach that resulted in a loss exceeding $290 million from KelpDAO. The incident, linked to an exploit of the omnichain interoperability protocol’s bridge, has sparked widespread criticism within the crypto community.

During the weekend, KelpDAO’s liquid restaking protocol was compromised, leading to a substantial theft of rsETH. This event has been labeled as the most considerable hack in decentralized finance (DeFi) for 2026, occurring shortly after another shocking event where Drift Protocol lost $285 million.

TRUSTED PARTNER

4.5 ★★★★☆

Review and Opinions →

🔥 Welcome Bonus 1.500$

150 FS 🏆

Open an account

In response to the breach, LayerZero shared its analysis, attributing the attack to a sophisticated operation believed to be orchestrated by the notorious Lazarus Group from North Korea. They claimed that this was primarily an infrastructure attack rather than a direct protocol failure. LayerZero stated that there was no risk of contagion to other cross-chain applications or assets.

The protocol explained that its design relies on modular security through Decentralized Verifier Networks (DVNs), which are tasked with ensuring the accuracy of cross-chain message verification. However, they alleged that the attackers had compromised the RPCs essential to the DVN’s functionality, which allowed them to manipulate transaction confirmations through a series of DDoS attacks.

LayerZero attributed the incident to KelpDAO’s choice of a single verifier configuration, noting that their security breach stemmed from this specific setup rather than the broader system. They maintained that the incident was entirely the fault of KelpDAO’s ‘1-of-1’ verifier approach.

This response has not been well-received among crypto enthusiasts. Many voiced their concerns on social media, questioning LayerZero’s accountability for the incident. One user drew a parallel by suggesting that blaming KelpDAO is akin to blaming vehicles for a bridge collapse—a diversion from the fundamental issues.

Others pointed out the inherent flaws in allowing a ‘1-of-1’ option if the DVN is meant to provide customizable security. One commenter argued that if the system permits this configuration, the design itself is at fault, not the user.

TRUSTED PARTNER

4.4 ★★★★☆

Review and Opinions →

🔥 100% up to 1 BTC

180 Free Spins 🏆

Open an account

Critics, including individuals with ties to the Chainlink community, expressed their disappointment with LayerZero for shifting responsibility entirely onto KelpDAO. They highlighted that LayerZero’s infrastructure was ultimately at risk, suggesting that KelpDAO’s reliance on their setup should not result in condemnation after a significant hack.

Additionally, concerns were raised regarding LayerZero’s proposed solution of transitioning to multi-DVN configurations. Some analysts, like The Smart Ape, contested this diagnosis, arguing that merely increasing the number of verifiers would not necessarily safeguard against future attacks. They emphasized that a coordinated attack could still compromise these newly introduced nodes.

To strengthen security, the analyst proposed that each verifier should operate its own full node using distinct software, hosted across different cloud providers and maintained by separate operational teams. This approach aims to ensure that verifiers operate independently, mitigating the risk of simultaneous compromises.

In conclusion, the KelpDAO incident has illuminated potential vulnerabilities in the LayerZero protocol, prompting calls for more robust security measures. As the community grapples with the implications of this hack, the need for transparent accountability and tangible safeguards within DeFi systems becomes ever more pressing.