Kelp announces migration to Chainlink… once again attacks LayerZero, claiming "knowing about security flaws but remaining silent"

Liquidity Staking Protocol Kelp Announces Migration to Chainlink Cross-Chain Interoperability Protocol (CCIP) After Nearly $300 Million Phishing Attack, LayerZero Dispute Over Responsibility Reignites

Event Details

On April 18 this year, a hacker group suspected to be linked to North Korea, Lazarus Group, exploited a vulnerability in Kelp to illegally mint 116,500 rsETH liquidity staked Ethereum tokens. Subsequently, the attacker transferred the stolen assets to the decentralized liquidity protocol Aave, borrowing out 106,497 ETH, resulting in a loss scale of up to $292 million to $294 million at the time’s market prices. Kelp immediately paused all contracts after discovering the attack and successfully intercepted two suspicious transactions worth a total of $100 million.

Dispute Over Responsibility

Initially, Kelp characterized the incident as an “attack on LayerZero infrastructure,” but LayerZero countered that Kelp did not adopt their recommended multi-DVN (Decentralized Validator Network) configuration, instead retaining a vulnerable “1-1” single validator setup, thus the responsibility lies with Kelp. Ripple’s former CTO David Schwartz also joined the debate, pointing out that LayerZero’s security protocol itself is sufficiently robust, and Kelp chose not to adopt it for convenience reasons.

Kelp responded again on Tuesday evening, stating that currently 47% of OApps (Omnichain Applications) still use the same “1-1” configuration, and 90% of messages processed by this infrastructure rely on only one or two DVNs. Kelp emphasized that LayerZero itself defaults to and recommends the “1-1” structure for deploying DVNs, and Kelp was simply following its guidelines.

Additionally, Kelp accused LayerZero of remaining silent on network infiltration, monitoring failures, and security vulnerabilities after discovering the DVN breach, and pointed out that LayerZero only ceased endorsing the “1-1” configuration signatures after the attack occurred.

Migration to Chainlink

To prevent similar attacks from happening again, Kelp has decided to migrate its cross-chain security infrastructure to Chainlink CCIP. Meanwhile, the rsETH token standard will shift from LayerZero’s OFT (Omnichain Fungible Token) to Chainlink’s CCT (Cross-Chain Token) standard. Kelp stated that Chainlink’s decentralized oracle network can provide a higher level of security for cross-chain communication compared to LayerZero, and the core team is currently finalizing the operational details of the migration.

According to data, despite the attack and significant fund outflows, Kelp’s total value locked (TVL) remains around $1.63 billion, indicating that the community still maintains considerable confidence in it.