David Schwartz, CTO Emeritus at Ripple, identified a pattern in bridge security vulnerabilities after the Kelp DAO rsETH bridge was exploited for approximately $292 million. During his evaluation of DeFi bridging systems for RLUSD use, Schwartz observed that bridge providers consistently deprioritized their most robust security mechanisms in favor of convenience, a pattern he believes may have contributed to the Kelp DAO incident.
The Security Features Sales Pitch
In his analysis shared on X, Schwartz described how bridge providers pitched advanced security features prominently, then immediately suggested those features were optional. “They generally in effect recommended not bothering to use the most important security mechanisms because they have convenience and operational complexity costs,” he wrote.
Schwartz noted that during RLUSD evaluation discussions, providers emphasized simplicity and ease of adding multiple chains “with the implicit assumption we wouldn’t bother using the best security features they had.” He summarized the contradiction: “Their sales pitch was that they have the best security features but they’re easy to use and scale, assuming you don’t use the security features.”
What Happened to Kelp DAO
On April 19, Kelp DAO identified suspicious cross-chain activity involving rsETH and paused contracts across mainnet and multiple Layer 2 networks. Approximately 116,500 rsETH was drained through LayerZero-related contract calls, worth around $292 million at current prices.
On-chain analysis from D2 Finance traced the root cause to a private key leak on the source chain, which created a trust issue with OApp nodes that the attacker exploited to manipulate the bridge.
LayerZero Security Configuration
LayerZero itself offers robust security mechanisms, including decentralized verification networks. Schwartz hypothesized that part of the problem may stem from Kelp DAO choosing not to use key LayerZero security features “out of convenience.”
Investigators are examining whether Kelp DAO configured its LayerZero implementation using a minimal security setup—specifically, a single point of failure with LayerZero Labs as the sole verifier—rather than utilizing the more complex but significantly more secure options available through the protocol.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Ice Open Network Suffers Data Breach; User Emails and 2FA Phone Numbers Exposed
Ice Open Network reported a security breach on April 15, revealing unauthorized access to user data, including email addresses and 2FA phone numbers, but no financial data was compromised. The incident, linked to former partners of a service provider, is under legal review, and users are advised to update security settings. The breach highlights escalating security issues in the crypto sector, with significant losses reported in recent months.
GateNews1h ago
Russian Crypto Exchange Grinex Halts Operations After $13M Hack, Threatening Sanctions Evasion Network
Russian cryptocurrency exchange Grinex ceased operations after a cyberattack caused losses over $13 million. The shutdown impacts Russian businesses' ability to convert rubles internationally and challenges the country's shadow finance system.
GateNews3h ago
Kelp DAO Hack Attributed to Lazarus Group; eth.limo Domain Hijacked via Social Engineering
LayerZero reported that the Kelp DAO exploit, attributed to North Korea's Lazarus Group, led to a loss of $292 million in rsETH tokens due to vulnerabilities in its decentralized verifier network. Additionally, eth.limo faced a domain hijacking from a social engineering attack, but DNSSEC mitigated severe damage.
GateNews7h ago
DeFi Hack Triggers $9 Billion in Outflows from Aave as Stolen Tokens Used as Collateral
A recent hack draining nearly $300 million from a crypto project led to a liquidity crisis on Aave, causing users to withdraw around $9 billion. Concerns over collateral quality prompted mass withdrawals, highlighting risks in DeFi lending.
GateNews8h ago
Ethereum Phishing Attack Drains $585K From Four Users, Single Victim Loses $221K WBTC
A coordinated Ethereum phishing attack drained $585,000 from four victims, exploiting user permissions through a deceptive link. This incident highlights the rapid loss of funds via social engineering, even under the guise of legitimacy.
GateNews9h ago
Pay attention to the signed content! Vercel is hit with ransomware demanding $2 million, and crypto protocol frontend security raises a red flag
The cloud development platform Vercel was breached by hackers on April 19. The attackers gained access through a third-party AI tool used by employees and threatened to extort $2 million. Although sensitive data was not accessed, other data may have been used. The incident has raised security concerns in the crypto community, and Vercel is currently investigating while advising users to rotate their keys.
ChainNewsAbmedia11h ago
