A dispute is brewing over who bears responsibility for a $300 million crypto exploit that hit on April 18. Decentralized finance protocol KelpDAO has publicly pushed back against LayerZero Labs’ explanation of the incident, alleging the bridge operator is deflecting blame for its own infrastructure breakdown.
The $300 million drain and its aftermath
The exploit drained more than $300 million from KelpDAO’s liquidity pools. Within days, the protocol shifted its rsETH holdings to Chainlink’s Cross-Chain Interoperability Protocol (CCIP) — a move that signals a permanent break with LayerZero’s bridging technology. The transfer was completed without further incident, the protocol said.
Whose fault? KelpDAO’s version
KelpDAO contends that LayerZero Labs’ account of the exploit misrepresents the root cause. In a statement, KelpDAO said LayerZero is “deflecting blame for its own infrastructure failures.” The protocol did not provide specific technical details, but the accusation suggests LayerZero’s bridge software had vulnerabilities that allowed the attacker to siphon funds.
LayerZero Labs has not responded to the challenge. The company’s initial post-exploit report described the incident as a targeted attack on KelpDAO’s configuration, not a systemic flaw in its bridging protocol. KelpDAO’s rebuttal directly contradicts that narrative.
rsETH migration to Chainlink CCIP
The decision to move rsETH — a liquid staking token — to Chainlink CCIP is the most concrete outcome so far. CCIP offers a different security model than LayerZero’s omnichain messaging. KelpDAO’s choice implies a lack of confidence in restoring trust with LayerZero. For now, the rsETH remains on CCIP, and KelpDAO has not indicated any plans to return to LayerZero’s infrastructure.
What’s next for the two protocols
The public he-said-she-said leaves a critical question unanswered: Was the exploit a result of LayerZero’s code or KelpDAO’s implementation? No independent audit has been released. Investigators are reportedly examining both the bridge logs and KelpDAO’s smart contracts. A resolution could hinge on forensic evidence — but no timeline for a report has been disclosed.
