Kelp DAO asserts that LayerZero’s ‘default’ settings were the true cause of the $290 million disaster. The liquid restaking protocol stated that the compromised verifier was part of LayerZero’s own infrastructure, and the setup it was criticized for using was LayerZero’s onboarding default.

Key Points:

• Kelp DAO is challenging LayerZero’s version of the $290 million rsETH bridge exploit, arguing that the compromised single-verifier setup relied on LayerZero’s infrastructure and defaults, rather than an outlier configuration they chose against advice.
• Security researchers claim LayerZero’s public documentation and deployment code promote single-source verification across major chains, undermining the firm’s claim that Kelp ignored guidance to adopt multi-verifier redundancy.
• Kelp states the attack was limited to the LayerZero-powered bridge and not its core restaking contracts, while LayerZero has responded by vowing to stop signing messages for any application using a single-verifier setup, forcing a broad migration.

The popular Spiderman meme showing three identical superheroes pointing fingers at each other is having its crypto moment today.

Kelp DAO is set to push back on LayerZero’s post-mortem of Sunday’s $290 million exploit, which essentially blames Kelp, a L2 source familiar with the matter told CoinDesk. Kelp plans to dispute the cross-chain messaging firm’s claim that it ignored repeated warnings to move away from a single-verifier setup. CoinDesk has reviewed and verified the memo Kelp plans to publish.

Kelp is a liquid restaking protocol that takes user-deposited ether, routes it through a yield-generating system called EigenLayer, and issues a receipt token, rsETH, in exchange.

LayerZero is the cross-chain messaging infrastructure that moves rsETH between blockchains, using entities called DVNs (decentralized verifier networks) to verify whether a cross-chain transfer is valid.

On Saturday, attackers drained 116,500 rsETH, worth about $290 million, from Kelp’s LayerZero-powered bridge by poisoning the servers that LayerZero’s verifier relied on to check transactions.

Kelp, the source said, is planning on saying the DVN that was compromised via what it calls a