LayerZero Issues Public Apology on May 8, Admits Fault in Single-Verifier Setup for Kelp DAO Exploit

According to The Block, LayerZero issued a public apology on Friday for its handling of the April 18 exploit that drained roughly $292 million in rsETH from Kelp DAO's cross-chain bridge. The protocol acknowledged it made a mistake by allowing its Decentralized Verifier Network (DVN) to serve as the sole verifier for high-value transactions, reversing its earlier position that blamed Kelp DAO's configuration choices.

LayerZero announced several remediation measures: the LayerZero Labs DVN no longer services 1/1 DVN configurations, default settings are being migrated to require at least five verifiers where possible with a floor of three, and the company is raising its multisig threshold from 3-of-5 to 7-of-10. The protocol also disclosed a previously unreported operational security incident from 3.5 years ago involving a multisig signer's misuse of production hardware for a personal trade. LayerZero said the exploit affected roughly 0.14% of total applications on the network.