$292 million big case, and in the end both sides are passing the buck—this scene is quite interesting.

Going back to April 18th, Kelp DAO was hacked and 116,500 rsETH were drained, marking the largest DeFi theft of the year. Afterwards, LayerZero released an investigation report indicating that the mastermind behind the attack was likely North Korea’s Lazarus Group. Their method was quite technical—they first infiltrated LayerZero’s DVN verification node network, targeted two RPC nodes, then launched DDoS attacks on other nodes, forcing the system to switch to compromised nodes, and finally signed false cross-chain transactions.

But here’s where it gets interesting. LayerZero harshly criticized Kelp in the report for using an extremely vulnerable “1-of-1 DVN” configuration, claiming it was basically a timed bomb for single points of failure, making it impossible to intercept false information. They also said they had long advised Kelp to diversify node configurations, but Kelp simply didn’t listen.

Kelp DAO was furious upon hearing this and immediately pushed back on Monday. They said that the so-called “single verification node configuration” was actually written into LayerZero’s official documentation as the default option for any new OFT tokens. Kelp has been operating on LayerZero since January 2024, and the two sides have been communicating continuously. When expanding to Layer 2, they even specifically discussed this issue, and LayerZero officials had explicitly confirmed that this configuration was appropriate.

Now, this is awkward. On one hand, LayerZero says “We’ve long advised you to change,” and on the other hand, they say “You’re using the default configuration as per official documentation, and it’s been confirmed to be fine.” The truth is not entirely clear to outsiders.

But overall, Kelp responded quickly—immediately suspending related contracts and blacklisting the hacker’s wallet, which helped control the situation. The team is now evaluating further security enhancements and aims to resume operations as soon as possible. This incident also serves as a reminder to the entire community that cross-chain security configurations should not be taken lightly; more careful consideration is needed.