David Schwartz, CTO Emeritus at Ripple, identified a pattern in bridge security vulnerabilities after the Kelp DAO rsETH bridge was exploited for approximately $292 million. During his evaluation of DeFi bridging systems for RLUSD use, Schwartz observed that bridge providers consistently deprioritized their most robust security mechanisms in favor of convenience, a pattern he believes may have contributed to the Kelp DAO incident.
The Security Features Sales Pitch
In his analysis shared on X, Schwartz described how bridge providers pitched advanced security features prominently, then immediately suggested those features were optional. “They generally in effect recommended not bothering to use the most important security mechanisms because they have convenience and operational complexity costs,” he wrote.
Schwartz noted that during RLUSD evaluation discussions, providers emphasized simplicity and ease of adding multiple chains “with the implicit assumption we wouldn’t bother using the best security features they had.” He summarized the contradiction: “Their sales pitch was that they have the best security features but they’re easy to use and scale, assuming you don’t use the security features.”
What Happened to Kelp DAO
On April 19, Kelp DAO identified suspicious cross-chain activity involving rsETH and paused contracts across mainnet and multiple Layer 2 networks. Approximately 116,500 rsETH was drained through LayerZero-related contract calls, worth around $292 million at current prices.
On-chain analysis from D2 Finance traced the root cause to a private key leak on the source chain, which created a trust issue with OApp nodes that the attacker exploited to manipulate the bridge.
LayerZero Security Configuration
LayerZero itself offers robust security mechanisms, including decentralized verification networks. Schwartz hypothesized that part of the problem may stem from Kelp DAO choosing not to use key LayerZero security features “out of convenience.”
Investigators are examining whether Kelp DAO configured its LayerZero implementation using a minimal security setup—specifically, a single point of failure with LayerZero Labs as the sole verifier—rather than utilizing the more complex but significantly more secure options available through the protocol.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Pay attention to the signed content! Vercel is hit with ransomware demanding $2 million, and crypto protocol frontend security raises a red flag
The cloud development platform Vercel was breached by hackers on April 19. The attackers gained access through a third-party AI tool used by employees and threatened to extort $2 million. Although sensitive data was not accessed, other data may have been used. The incident has raised security concerns in the crypto community, and Vercel is currently investigating while advising users to rotate their keys.
ChainNewsAbmedia1h ago
KelpDAO Loses $290M in Lazarus Group LayerZero Attack
KelpDAO faced a $290 million loss due to a sophisticated security breach linked to the Lazarus Group. The attack exploited configuration weaknesses in their verification system and highlighted the risks of relying on a single-point verification setup. Industry experts emphasize the need for improved security configurations and multi-layer verification to prevent future incidents.
CryptoFrontier2h ago
LayerZero responds to Kelp DAO’s 292 million incident: it indicates that Kelp set up a custom 1-of-1 DVN configuration, and the attacker was North Korea’s Lazarus.
LayerZero issued a statement regarding the $292 million hack suffered by Kelp DAO, accusing Kelp’s self-selected 1-of-1 DVN configuration of making the incident possible. The attacker was the North Korean Lazarus Group. LayerZero emphasized that this incident stems from configuration choices and that it will no longer support this kind of vulnerable setup. In addition, responsibility is still disputed, and no compensation plan has been provided.
ChainNewsAbmedia2h ago
DeFi hackers stole $600 million in April; Kelp DAO and Drift accounted for 95% of the monthly losses
In April 2026, within just 20 days, cryptocurrency protocols suffered losses of more than $606 million due to hacker attacks, becoming the worst single-month loss record since the February 2025 exchange incident in which $1.4 billion in data was leaked. The two attacks by KelpDAO and Drift Protocol accounted for 95% of April’s losses, and 75% of the total $771.8 million losses as of now in 2026.
MarketWhisper2h ago
Vercel Breach Linked to AI Tool Context.ai Compromise Raises Risk for Crypto Frontends
Vercel confirmed a security breach caused by a compromised AI tool, leading to the theft of employee and customer data. The incident poses risks to the Web3 ecosystem, and the attacker is attempting to sell the stolen data for $2 million. Vercel is addressing the situation with law enforcement and incident response experts.
GateNews2h ago
rsETH LayerZero bridge hacked, Aave and other protocols urgently freeze funds
Kelp DAO’s liquidity re-staking token rsETH was attacked on April 19 by a hacker exploiting a cross-chain message verification vulnerability, resulting in 116,500 rsETH being released to an address controlled by the attacker. Multiple DeFi protocols urgently froze related functions to address potential losses. LayerZero stated that it is actively fixing the vulnerability and will release a post-incident analysis report.
MarketWhisper5h ago
