Nikolas Sargeant
TL;DR
-
Kelp DAO has countered LayerZero’s earlier statement, saying the 1-of-1 DVN setup under criticism was shipped as the default at LayerZero.
-
The attack, likely linked to North Korea’s Lazarus Group, led to the theft of 116,500 rsETH.
Kelp DAO Blames LayerZero for Recent Hack
Kelp DAO issued a statement on Monday addressing its involvement in the $292 million exploit that occurred over the weekend, downplaying its direct responsibility for the incident.
On April 18, Kelp DAO, utilizing the LayerZero-powered cross-chain bridge, lost 116,500 rsETH tokens valued at around $292 million—marking it as the largest DeFi exploit of the year.
According to LayerZero, the attack, likely attributed to North Korea’s Lazarus Group, involved the attacker gaining access to LayerZero Labs' decentralized verified network (DVN) RPC nodes.
The attacker then poisoned two nodes and initiated a DDoS attack, tricking the DVN into accepting a fake cross-chain message and approving a fraudulent transaction.
LayerZero criticized Kelp DAO for using a 1-of-1 DVN configuration, emphasizing that the lack of independent verification created a single point of failure, which contributed to the exploit.
The report also noted that LayerZero and other external parties had recommended DVN diversification to Kelp DAO, but the platform chose not to adopt those suggestions.
Kelp DAO’s response shifted the blame back to LayerZero, stating that the 1-of-1 DVN setup was the default configuration outlined in LayerZero's documentation. Kelp also confirmed that the setup had been deemed "appropriate" during discussions about its expansion to Layer 2 (L2) earlier in 2024.
In its statement, Kelp DAO maintained that its initial actions, such as pausing contracts and blacklisting attacker wallets, helped mitigate the situation. The DAO also stated that it was working on resuming the protocol and resolving the incident.
Kelp’s Hack Affects Aave
The effect of the hack was not limited to Kelp; other DeFi protocols, especially Aave, have also been affected. The attacker deposited stolen assets into Aave V3, raising concerns about potential bad debt scenarios.
The hacker used rsETH as collateral to borrow large amounts of WETH, causing the protocol’s positions to reach dangerously low health factors.
According to Aave's incident report, the attacker deposited 89,567 rsETH (valued at around $221 million) and borrowed 82,650 WETH and 821 wstETH. Aave outlined two potential bad-debt scenarios, with the first assuming a uniform loss across all chains, which could lead to $123.7 million in bad debt. The second scenario, which isolates the losses to L2 rsETH, could result in higher bad debt of $230.1 million across L2 markets.
Aave stated that the outcome would depend on external decisions, including how the rsETH accounting and the LRTOracle exchange rate are updated.
Despite the risks, Aave assured users that it has a strong balance sheet with $181 million in assets and has secured support from ecosystem participants to assist in case of bad debt.
The Arbitrum Security Council also announced earlier today that it has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit.
