Kelp Dao'S "Additional Context" On $292m Rseth Drain Disputes Layerzero Account

@KelpDAO has published a detailed rebuttal to @LayerZero_Core following the April 18 rsETH bridge exploit, pushing back against LayerZero's characterisation that Kelp's own security choices were responsible for the $292 million drain.

At the centre of the dispute is the 1-of-1 Decentralised Verifier Network configuration that LayerZero described as an outlier. Kelp contests this directly, arguing the setup is the documented default included in LayerZero's own V2 OApp Quickstart guide, and that approximately 40% of protocols currently running on LayerZero use the same configuration. Kelp also states that its working relationship with the LayerZero team, established since 2024, produced no specific guidance to modify the rsETH DVN settings, and that the defaults were explicitly confirmed as appropriate during Kelp's Layer 2 expansion.

On the infrastructure failure itself, Kelp says two of LayerZero's own RPC nodes were compromised and a third was taken offline via a distributed denial-of-service attack. Kelp's position is that this was LayerZero-operated infrastructure, and that the root cause therefore sits with LayerZero, not with configuration decisions made by Kelp.

Kelp's emergency pause, triggered 46 minutes after the exploit began, blocked two subsequent attempts that would have released a further 40,000 $rsETH, valued at roughly $95 million. Yearn contributor banteg and Chainlink community manager Zach Rynes both publicly aligned with Kelp's account of events.

LayerZero has since said it will cease signing messages for any application running a 1-of-1 DVN setup, a move that would require a protocol-wide migration across affected projects.