LayerZero's single-signature setup is to blame; the security model of cross-chain bridges needs to be re-evaluated.

ME News reports that the initial analysis of the Kelp theft incident suggests that the attacker exploited LayerZero's single-signature 1/1 DVN configuration (which contradicts the official 2/2 recommendation), suspected to be influenced by social engineering. The attack stole 116,500 rsETH on Ethereum and previously attempted to steal 40,000 rsETH but failed, with transaction fees coming from Tornado Cash. The funds were dispersed and laundered, with the pressure transmitted to staking platforms, especially causing massive bad debt on Aave.