Kelp: The theft was caused by LayerZero's RPC node being compromised.

Mars Finance reports that Kelp DAO’s official account on X stated that the theft was caused by the compromise of two RPC nodes hosted by LayerZero, while a third RPC node was hit by a DDoS attack. This was an attack targeting LayerZero’s infrastructure; Kelp’s own system was not involved in the construction or operation of that infrastructure. The 1/1 DVN configuration is a solution documented in LayerZero’s documentation and is the default setting for all new OFT deployments. Since January 2024, Kelp has been operating on LayerZero infrastructure and has maintained open communication with the LayerZero team. During Kelp’s expansion to Layer2, the DVN configuration was discussed, and the default configuration was explicitly confirmed as appropriate. Kelp’s current top priority is to safeguard user interests and prevent risks from spreading within the DeFi ecosystem. The team is working with various parties within the ecosystem to analyze the impact, seek support, and explore all possible mitigation strategies.