Kelp DAO has accused LayerZero personnel of approving the single-verifier configuration later blamed for the April 18, 2026 rsETH bridge exploit, which drained roughly $292 million. The protocol published screenshots and configuration references to support its claim, escalating a dispute over whether the failure was a Kelp misconfiguration or a LayerZero infrastructure and guidance failure.
The claim matters because responsibility for the exploit affects how asset issuers evaluate bridge providers, developer defaults and third-party verification networks. If Kelp’s account is accurate, the problem was not only an application-level mistake, but a broader failure in default configuration design and risk signaling.
Kelp Points to Defaults and Prior Approval
Kelp says LayerZero staff participated in integration discussions over multiple years and did not object to the use of default verifier settings. One screenshot shows a LayerZero team member saying, “No problem on using defaults either.” Kelp also pointed to developer materials and example configurations that it says normalized a 1-of-1 verifier setup.
LayerZero’s initial incident statement framed the problem around applications using a 1-of-1 configuration and said its DVN would no longer sign or attest messages from apps using that setup. The company also said it was contacting applications using 1-of-1 configurations to migrate toward multi-DVN redundancy.
Dune data showed that roughly 47% of LayerZero OApps relied on a 1-of-1 DVN configuration, reinforcing Kelp’s argument that the setup was not rare across the ecosystem.
Bridge Risk Moves Beyond Smart Contracts
Security analysis described the exploit as involving a single-node LayerZero DVN and upstream RPC-provider compromise, with initial attribution pointing to a North Korea-aligned threat actor. Brale’s incident response said KelpDAO suffered a roughly $290 million loss from that configuration combined with an attack on RPC providers.
The core lesson is that smart-contract audits alone do not cover bridge infrastructure risk. Applications also inherit assumptions from verifier networks, RPC governance, developer defaults and off-chain operational controls.
LayerZero’s policy change effectively forces migration away from single-verifier configurations. Kelp’s move to migrate rsETH to Chainlink CCIP reflects a broader shift toward multi-party verification models, where asset issuers seek stronger redundancy and clearer fault tolerance.
Bridge due diligence must include verifier topology, RPC dependency, signing thresholds and default-configuration governance. The rsETH exploit has become a live case study in how off-chain infrastructure can become the true point of failure for on-chain assets.
