LayerZero Admits to "Mistakes" and Takes Responsibility in $292 Million Kelp DAO Breach

LayerZero published a blog on Friday evening, rarely admitting to its own mistakes in the $292 million hack that affected Kelp DAO in April. Previously, LayerZero mainly attributed the responsibility to application layer configuration issues of Kelp DAO, but now it is taking proactive responsibility.
LayerZero stated that its decentralized verification network (DVN) allows high-risk "1-of-1" single verification configurations to protect high-value transfers, which is a key factor leading to the vulnerability. The company explicitly apologized and announced it will no longer support 1/1 DVN configurations, with all paths default migrating to higher security thresholds (such as 5/5 or 3/3).
The company emphasized that LayerZero's underlying protocol itself was not compromised; the vulnerability stemmed from an attack targeting its internal RPC infrastructure. At the same time, LayerZero reiterated that developers still need to be responsible for their own security settings.
This admission has had a noticeable impact on LayerZero's business: Kelp DAO has migrated its rsETH bridge to Chainlink; Solv Protocol also announced it would transfer over $700 million worth of tokenized Bitcoin infrastructure away from LayerZero.
LayerZero's change in attitude reflects the complexity of security responsibility attribution in the cross-chain bridge field. This incident once again highlights that cross-chain infrastructure, as an important part of the crypto ecosystem, still faces multiple challenges such as configuration risks, single points of failure, and external attacks. The industry is accelerating reassessment of security providers, and choosing higher security thresholds has become a trend. This may help promote higher security standards across the cross-chain sector, but also puts some pressure on LayerZero's market trust and business development.
The above content is based on public statements and reports for reference only and does not constitute any investment advice or financial opinion. Crypto assets and related projects carry high risks; participation should be cautious and in strict compliance with relevant laws and regulations in Mainland China and Hong Kong.
$ETH