The most recent news about crypto industry at Cointelegraph. Latest news about bitcoin, ethereum, blockchain, mining, cryptocurrency prices and more
LayerZero said that Kelp’s DVN setup allowed the $290 million exploit, as investors questioned which protocol would step up to cover the shortfall.Interoperability protocol LayerZero claims that an inadequate setup tied to Kelp’s decentralized verifier network enabled malicious actors to steal $290 million from Kelp DAO, adding that preliminary signs point to North Korea-linked threat actors.
Monday that the exploit stemmed from a single point of failure in Kelp’s setup, which relied on a single LayerZero DVN as the only verified path, despite LayerZero previously advising them against this. “LayerZero and other external parties previously communicated best practices around DVN diversification to KelpDAO. Despite these recommendations, KelpDAO chose to utilize a 1/1 DVN configuration.” In practice, that meant Kelp relied on a single verification path for cross-chain messages rather than requiring multiple independent checks. The exploit quickly shifted attention from the technical cause to the question of who should absorb the losses, while the fallout spread into Aave, where the attacker used rsETH as collateral to borrow real liquidity.to $17.5 billion at the time of writing after the exploiter used the stolen funds to borrow on Aave, leaving about $195 million in “bad debt,” triggering withdrawals on the lending protocol.LayerZero said Kelp’s rsETH bridge relied solely on the LayerZero Labs DVN, and argued that the incident reflected an unsafe application configuration rather than a compromise of LayerZero itself. The company said it is now urging all applications using 1/1 DVN setups to migrate to multi-DVN configurations and will stop signing or attesting messages for apps that retain the single verifier design.With no recovery or compensation plan yet announced, users and market observers spent Monday debating whether losses should sit with Kelp DAO, LayerZero, Aave or rsETH holders themselves. Yishi Wang, founder and CEO of open-source hardware wallet OneKey, said that the best path forward was to negotiate with the hacker, offer a 10% to 15% bounty, and get the bulk of the funds back. “If negotiations fail, LayerZero’s ecosystem fund should foot the bulk of the bill—it’s got the deepest pockets and the most long-term skin in the game,” wrote the founder in a Monday X, adding that Kelp DAO is “broke” and could make it up with tokens and future revenue, or consider selling the project. Analytics platform DeFiLlama’s pseudonymous founder, 0xngmi, outlined three solutions, including the option to “socialize” losses among all users, “rug rsETH holders on L2s,” or try to return holder balances to a pre-hack snapshot, which would be “very hard to do,” he wrote in a Monday XThis low liquidity presents a “critical safety risk where liquidations of ETH collateral cannot take place while markets are at 100% utilization,” said MoneySupply, the pseudonymous head of strategy at Aave competitor lending protocol Spark, in a Saturday X “With current illiquidity conditions on Aave, a 15-20% ETHUSD price drop could cause significant bad debt accumulation ,” he said.Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy
United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chainsAn attacker drained 116,500 rsETH, roughly 18% of circulating supply, from Kelp's LayerZero-powered bridge on Saturday, triggering emergency freezes across Aave, SparkLend, Fluid and Upshift.
Read more »
Aave records $6 billion TVL drop as Kelp hack exposes structural risk at DeFi lenderThe AAVE token fell 16% and deposits fled the protocol after attackers used drained rsETH as collateral to borrow wrapped ether, leaving Aave to quantify how much bad debt it is now carrying.
Read more »
Kelp exploit highlights problem with non-isolated DeFi lending: Crypto execsThe most recent news about crypto industry at Cointelegraph. Latest news about bitcoin, ethereum, blockchain, mining, cryptocurrency prices and more
Read more »
The $292 million Kelp crypto exploit: how it happened, and what it means for DeFi2026 is shaping up to be DeFi's 'worst year in terms of hacks,' Ledger's CTO said, as the Kelp exploit shows how a single point of failure can cascade across systems.
Read more »
LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's LazarusLayerZero said the attackers compromised two RPC nodes the company's verifier relied on and DDoS'd the rest, with the attack working only because Kelp had ignored multi-verifier recommendations.
Read more »
Aave's TVL tanks $8B a day after $293M Kelp DAO hackThe most recent news about crypto industry at Cointelegraph. Latest news about bitcoin, ethereum, blockchain, mining, cryptocurrency prices and more
Read more »