Written by: Murugaverl Mahasenan, CATENAA
Tuesday, May 12, 2026 — KelpDAO has accused LayerZero's infrastructure of contributing to a $292 million exploit and said it will migrate its cross-chain system to Chainlink as it rebuilds its liquid staking token framework. The incident is one of the largest DeFi security breaches this year.
At the center of the dispute is an attack in April that resulted in the theft of approximately 116,500 rsETH, an Ethereum-based liquid staking token that can be transferred across blockchains.
The attack targeted a bridge system that allows rsETH to move between multiple blockchain networks. Security researchers have linked the incident to the North Korean hacking group Lazarus Group, which has been associated with several high-value cryptocurrency thefts.
Core Responsibility
KelpDAO stated that the design of LayerZero's infrastructure played a central role in the vulnerability. The protocol said that due to the use of a single validator in the system configuration, attackers were able to manipulate the transaction verification process after compromising part of the routing infrastructure.
KelpDAO said this weakness allowed fraudulent cross-chain transactions to be approved without adequate verification.
LayerZero denied this claim. The company said the attack was limited to Kelp's specific implementation, noting that Kelp used a single-validator configuration, which deviated from LayerZero's recommended multi-validator architecture.
The disagreement between the two parties has escalated into a public debate centered on how responsibility should be allocated in decentralized cross-chain systems.
KelpDAO said that multiple security firms, including Chainalysis and SEAL 911, support its assessment that the vulnerability stemmed from issues in LayerZero's infrastructure configuration.
KelpDAO also claimed that the exploited single-validator model was not unique to Kelp but was widely adopted by other applications within the ecosystem.
The protocol said attackers successfully infiltrated remote procedure call (RPC) nodes associated with the validator network, allowing them to inject fraudulent transaction data.
This data was subsequently accepted by the system, enabling the attackers to transfer funds across multiple blockchain networks without authorization.
KelpDAO stated that following the incident, LayerZero updated its policies and no longer supports single-validator configurations. KelpDAO believes this change indicates that the previous design indeed posed systemic risks that were not adequately addressed before the attack.
LayerZero maintained that its documentation has always recommended multi-validator security configurations and stated that protocols are responsible for their own deployment and configuration methods.
As of now, LayerZero has not released a detailed technical response to KelpDAO's latest allegations.
Asset Freezes and Legal Proceedings
The impact of the attack has extended beyond the technical dispute. Approximately $71 million in assets linked to the attack have been frozen on the Arbitrum network, triggering legal proceedings in the New York federal court. The current focus of the case is whether these frozen assets should be returned or remain frozen pending further investigation.
KelpDAO said the incident raises broader questions, including the allocation of responsibility within cross-chain infrastructure and the risks associated with reliance on single points of validation. The protocol stated that the experience has exposed structural weaknesses and highlighted the need to move toward more decentralized validation mechanisms.
Migration to Chainlink
As part of its response, KelpDAO announced it will migrate its rsETH system to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The new system will use multiple independent validators to approve transactions, reducing reliance on a single entity for verification.
Chainlink confirmed its involvement in the migration and said it is working with KelpDAO to improve cross-chain security. The company stated that decentralized finance requires more robust infrastructure to reduce systemic risks if it is to achieve mass adoption.
Johann Eid, Chief Business Officer at Chainlink, said secure interoperability is essential for the long-term development of blockchain-based finance. He said protocols must ensure that cross-chain activities are not compromised by a single point of failure.
This move marks a significant shift for KelpDAO, which previously relied on LayerZero's infrastructure for its cross-chain operations. KelpDAO stated that, following the incident, it is redesigning its system to prioritize security and transparency.
Industry Impact
This attack is one of the largest disclosed DeFi security breaches in 2026 and has reignited concerns over the vulnerability of cross-chain bridges. Cross-chain bridges remain among the most targeted components of blockchain infrastructure.
Industry analysts noted that cross-chain systems introduce complex security risks due to the need to coordinate validation across multiple networks. Even minor configuration flaws can create attack surfaces that are difficult to detect in a timely manner.
The incident has also intensified discussions about whether decentralized systems should adopt lightweight validation models or more resource-intensive multi-validator frameworks. Proponents of simpler systems value efficiency, while critics argue that such models amplify systemic risks.
As of publication, LayerZero had not publicly responded to KelpDAO's latest statements.
As investigations continue and legal proceedings unfold, this case is expected to influence how future cross-chain protocols design their validation systems and how responsibility is allocated in future DeFi incidents. KelpDAO said its current focus is on securing rsETH and restoring user confidence during the migration to Chainlink's infrastructure.
