LayerZero Admits Fault in $292 Million Kelp Exploit, Shifts Strategy
By John Nada·May 9, 2026·4 min read
LayerZero admits fault in a major security breach, shifting its strategy to enhance security measures following a $292 million exploit.
LayerZero has acknowledged its mistake in a significant security breach, admitting it allowed its verification infrastructure to protect high-value assets in a vulnerable configuration. This admission marks a critical shift from its earlier stance of blaming Kelp DAO for a $292 million hack linked to North Korean attackers. In a blog post, the company stated, 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions.'
Initially, LayerZero had attributed the exploit to Kelp's risky decision to utilize a '1-of-1' configuration, which created a single point of failure. The company has since taken responsibility, stating, 'We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that.' This acknowledgment of fault is particularly significant as it reverses weeks of public finger-pointing between LayerZero and Kelp over the responsibility for the exploit. LayerZero's initial framing of the incident as a developer configuration failure now contrasts sharply with its current stance, emphasizing the need for accountability at all levels of the protocol's operation.
In response to this exploit, LayerZero plans to migrate all configurations to at least a '3/3' setup to enhance security. The company's intention to eliminate the '1/1' configurations is a proactive step to fortify its infrastructure against future attacks. It is critical to note that a decentralized verifier network (DVN) is integral to the security of cross-chain transactions, as it verifies whether a transaction moving assets between blockchains is legitimate. By implementing a minimum of a '3/3' setup, LayerZero aims to mitigate the risk associated with single points of failure, which have historically been targets for attackers.
The LayerZero protocol itself remains unaffected, with the company clarifying that the exploit targeted its internal RPC infrastructure. This internal vulnerability led to significant security concerns, especially as external RPC providers simultaneously faced distributed denial-of-service attacks. Such attacks highlight the precarious nature of blockchain infrastructure, where multiple layers of security are necessary to protect against a diverse array of threats. LayerZero's proactive measures include removing a signer who misused a multisig hardware wallet, rotating wallets, and improving security practices around signing devices. These actions are essential as they reinforce the importance of stringent security protocols in the management of digital assets.
Adding to the tension in the ecosystem, competitors such as Chainlink are leveraging the vulnerabilities exposed by the exploit. Kelp has already transitioned its rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol, a move that underscores the shifting dynamics in the blockchain sector. Furthermore, Solv Protocol is moving more than $700 million in tokenized bitcoin infrastructure away from LayerZero, indicating a growing concern about security practices and infrastructure reliability within the crypto space. These migrations reflect a broader trend where protocols are reevaluating their partnerships and the security measures of their chosen infrastructure providers.
As cross-chain bridges remain a crucial yet vulnerable element of blockchain technology, LayerZero's admission underscores the importance of security in maintaining trust among users and developers. The repercussions of this exploit may prompt other protocols to rethink their security measures, particularly those relying on single points of failure. Investors and stakeholders must now consider the implications of these vulnerabilities, as they may influence future decisions regarding protocol partnerships and infrastructure investment.
LayerZero's recent blog post also addressed past practices, revealing that three and a half years ago, one of its signers had used their multisig hardware wallet to perform a personal trade. This incident, which the company categorically stated was “not ok,” led to the removal of that signer from the multisig, wallet rotations, and an update of security practices surrounding signing devices. The introduction of localized anomaly detection software on each device and the creation of a custom-built multisig called OneSig are indicative of LayerZero's commitment to improving its security infrastructure.
The implications of this incident extend beyond LayerZero and Kelp. As the crypto ecosystem reacts to the vulnerabilities revealed by the exploit, other protocols may feel pressured to enhance their security measures to prevent similar incidents. The competitive landscape is shifting, and projects that can demonstrate robust security practices may gain a significant advantage in attracting users and investments.
The Kelp exploit incident serves as a stark reminder of the vulnerabilities inherent in blockchain technology, particularly in cross-chain interactions. As developers and investors assess their risk exposure in light of LayerZero's admission, the call for improved security standards across the board is louder than ever. The evolution of security practices in the crypto industry will likely be a focal point of discussion in the coming months, as stakeholders seek to rebuild trust and confidence in cross-chain solutions.