The KelpDAO hack on April 18 drained $292 million from rsETH and triggered precautionary suspensions on at least 30 protocols that use LayerZero as the infrastructure for moving assets between different networks. No loss of funds was reported and the outage is precautionary and is being carried out independently by each project while an investigation into the exploit is still being conducted.
The reasons for the project suspending operations are as follows: Everyone shares infrastructure Faced with uncertainty about the true scope of LayerZero’s attack, they chose to pause before determining whether their own configurations were at the same risk as KelpDAO.
The 30 projects include:
- Curve Finance has suspended bridging of CRV tokens from networks such as BNB Chain and Avalanche.
- TRON DAO has suspended the OFT Bridge (standard cross-chain token transfer mechanism) for its native cryptocurrency TRX.
- Morpho has suspended the OFT bridge for MORPHO tokens on Arbitrum, similar to TRON DAO.
- BitGo and Wrapped Bitcoin (WBTC) have jointly suspended the so-called LayerZero DVN channel that allows movement of WBTC tokens (wrapped versions of Bitcoin) until the security of the network is verified.
- Tether’s cross-chain tradable version of USDT, USDT0, crippled its bridging infrastructure by making it clear that all tokens remain backed 1:1 by USDT.
Complete list of suspended projects: Ethena, ether.fi, River, Pudgy Penguins, Agora, f(x) Protocol, Matrixdock, ApeCoin, Euler Labs, Katana, Orderly Network, mETH Protocol, Solv Protocol, MOCA Coin, Re, Avant, Beefy Finance, Flare Networks, Lombard, infiniFi, Suilend, Kamino, Swell and Frax Finance.
LayerZero claims KelpDAO is responsible for hacking
As reported by CriptoNoticias, the team behind LayerZero has confirmed that the protocol works correctly and It is believed that the attack may have been possible as a result of an operational error by KelpDAO. Additionally, the Interoperability Protocol Team accused KelpDAO of ignoring security recommendations.
According to a report published by LayerZero, KelpDAO was operating in a 1-of-1 DVN configuration. Rely on a single transaction validator LayerZero Labs’ proprietary DVN requires no additional independent verifiers between chains.
Under this logic, even if LayerZero Labs’ DVN had been compromised in the same way as KelpDAO, a project with multiple independent verifiers would have blocked the attack. The 30 suspended projects did not report any losses, but they also did not disclose what configurations they were using, raising concerns.
However, the large-scale response reveals that technical discussions were not enough to contain the loss of trust in shared infrastructure. None of the available communications establish a resumption date.
(Tag translation) Blockchain
