LayerZero and Kelp DAO Trade Blame Over $292M rsETH Bridge Exploit

The cryptocurrency industry's second-largest hack of 2026 has crystallised into a public dispute between a liquid restaking protocol and the cross-chain infrastructure provider it had relied upon. Kelp DAO confirmed on 5 May 2026 that it had migrated $292 million in rsETH off LayerZero's Omnichain Fungible Token (OFT) standard to Chainlink's Cross-Chain Interoperability Protocol (CCIP), days after attackers linked to North Korean state actors drained the funds through what Kelp described as a flaw in LayerZero's configuration. LayerZero's co-founder and CEO Bryan Pellegrino has rejected that characterisation, tellingCoinTelegraph on 6 May that an independent postmortem by external security firms would soon be published and would complicate Kelp's framing.

The scale of the exploit — which represents the second-largest DeFi hack this year — has amplified pressure on both parties to demonstrate accountability to their respective user bases and to the broader ecosystem. Cross-chain bridges have become load-bearing infrastructure for decentralised finance, moving billions of dollars in assets between networks; when that infrastructure fails at scale, the reputational and financial consequences ripple across every protocol that depends on it. Kelp DAO's decision to migrate wholesale to a competitor's standard signals that, at least in the protocol's own assessment, the dispute is not merely a technical disagreement but a question of trust.

What Kelp DAO Claims Happened

According to the explanation Kelp DAO advanced through its official channels and as reported by CryptoBriefing, the attackers exploited a specific configuration within LayerZero's OFT standard that, in Kelp's view, should not have been approved or should have been flagged as unsafe. The OFT standard allows tokens to be minted and transferred across multiple chains from a single canonical contract; if the configuration governing which chains can receive a token, and under what conditions, is set incorrectly, the door opens to untrusted minting. Kelp's position is that LayerZero approved the setup that created this exposure — a claim that, if sustained, would shift liability for the exploit from Kelp's own operational decisions onto LayerZero's infrastructure design.

The exploit itself has been attributed by multiple blockchain analytics firms to actors with links to the Lazarus Group, the North Korean state-sponsored hacking operation responsible for billions in cryptocurrency thefts over the past decade, including the 2022 Ronin Bridge hack and the 2024 DMM Bitcoin theft. North Korean cyber operations have shown particular sophistication in targeting bridge infrastructure precisely because bridges concentrate large volumes of assets in a single contract. The $292 million figure places this attack among the five largest crypto exploits on record.

LayerZero's Rebuttal

Pellegrino's pushback suggests LayerZero believes the fault lies not in the OFT standard itself but in how Kelp DAO configured and deployed it. In an exchange reported by CoinTelegraph, the LayerZero CEO disputed that the infrastructure was to blame and indicated that external security researchers had been engaged to conduct a postmortem examination of the incident. That postmortem has not yet been published as of this article's filing, and its conclusions will be pivotal: if the review finds that Kelp's configuration deviated from recommended practices, LayerZero's infrastructure will be exonerated; if it finds that the OFT standard contains structural vulnerabilities that were not adequately disclosed, Kelp's migration decision will be validated.

The dispute carries high stakes for LayerZero's broader business. The OFT standard is one of the protocol's flagship products, and several other DeFi protocols currently use it for cross-chain token deployments. Any suggestion that the standard contains systemic vulnerabilities could prompt a wider migration wave and accelerate consolidation toward Chainlink's CCIP, which has positioned itself as the more conservative, enterprise-grade cross-chain option. Chainlink's CCIP uses a different architecture — relying on a risk management layer and a dedicated token transfer mechanism — that its advocates argue is harder to misconfigure in ways that allow untrusted minting.

The Structural Problem With Cross-Chain Bridges

What this episode exposes is not merely a bilateral dispute but a structural fragility in how decentralised finance handles cross-chain asset movement. Bridges operate by trust-minimising assumptions about the relationship between origin and destination chains; if those assumptions break down — through misconfiguration, through novel attack vectors, or through the emergence of state actors with sufficient technical skill to exploit both — the losses can be catastrophic. The DeFi ecosystem has seen this pattern repeatedly: the Wormhole bridge hack in 2022, the Nomad bridge hack later that year, Ronin in 2022, and now this Kelp exploit. Each time, the post-incident review produces new security practices; each time, those practices are adopted unevenly across the ecosystem.

The North Korean attribution is not incidental. Lazarus Group's crypto operations are understood to be a significant revenue source for the Democratic People's Republic of Korea's weapons programme, and the group's technical capabilities have historically outpaced the defensive postures of the DeFi protocols it targets. This means that even protocols with sound engineering fundamentals can be caught out by attackers who have the patience to map configurations, identify edge cases, and time their exploits to maximise extraction. The $292 million figure represents, in a very concrete sense, a transfer of value from DeFi participants to a sanctioned foreign state's military budget — a detail that is frequently lost in the technical framing of these incidents.

What Remains Unresolved

Several factual questions remain open as of filing. The precise mechanism by which the attackers generated untrusted rsETH mints has not been publicly disclosed by Kelp DAO or by LayerZero; both parties appear to be awaiting the results of the independent postmortem before committing to a detailed technical account. The sources do not indicate whether Kelp DAO has filed a formal complaint with law enforcement, though the North Korean attribution would typically trigger coordination with the FBI and with OFAC's sanctions apparatus. The broader question of whether LayerZero's OFT standard contains vulnerabilities that affect other deployed protocols — and whether those protocols have been notified — is also unaddressed in the available source material.

The migration to Chainlink's CCIP resolves Kelp DAO's immediate exposure but does not resolve the industry's structural vulnerability to bridge exploits. CCIP's risk management layer adds friction and cost to cross-chain transfers that some DeFi users may find unacceptable; whether it materially reduces the probability of a future exploit at this scale remains to be demonstrated in practice. What is clear is that the $292 million that moved out of Kelp DAO on the night of the exploit did not move quietly — it moved through infrastructure that the industry collectively depends on, and its departure has left behind a dispute that will define how cross-chain security responsibilities are assigned for years to come.

Kelp DAO's migration to Chainlink CCIP is underway as of this article's filing. LayerZero's postmortem is expected within the coming week.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/CryptoBriefing/99999