Sadie

Honestly, if I got duped by a vendor, I would ask for a refund! If my vendor blames me for choosing them, I would be furious! Because I’m sure you would have promised the highest level of security, etc., etc., during the sales process. Either way, you should address the bigger issue this tweet points to. x.com/chainlinkgod/s…

A ton of this is just completely untrue. 1) Kelp originally used the defaults which were MultiDVN or DeadDVN and manually migrated to a 1/1 config later 2) Almost 100% of the volume on a 1/1 config was rsETH 3) Not using a 1/1 for production applications is mentioned many times in the documentation. The defaults Kelp is referencing in their screenshot were multiDVN or DeadDVN, which force-rejects an application using the defaults at all and requires them to manually set configuration. rsETH was originally configured to use the default LayerZero configuration of a multiDVN setup of LayerZero Labs + Google: Here are the exact transactions where that happens Ethereum → Arbitrum: etherscan.io/tx/0xd7c864adb… at 2024-02-06 03:09:47 UTC Ethereum → Optimism: etherscan.io/tx/0x7075bfe9a… at 2024-02-06 03:09:59 UTC KelpDAO then manually changed these to 1/1 configs: For the original Feb 6 Ethereum routes to Arbitrum/Optimism, KelpDAO’s Ethereum contract switched from defaults to manual OApp-scoped config on 2024-04-01: Send-side manual config: etherscan.io/tx/0x7485c16c9… 2024-04-01 07:12:11 UTC Receive-side manual config: etherscan.io/tx/0x21e967c99… 2024-04-01 07:12:23 UTC From this point on, Kelp began deploying all of their configurations as 1/1 configs. Here is Kelp’s deployment on Unichain: Unichain → Ethereum was opened on 2025-04-01 18:55:41 UTC. Pathway-open / setPeer tx: uniscan.xyz/tx/0x31ea2b10a… The manual ULN config followed 6 seconds later in uniscan.xyz/tx/0xd8ef5416a…. During this time the Unichain -> Ethereum and Ethereum -> Unichain defaults were set to DeadDVN which is a contract which makes it impossible for any application to transact without manually configuring their DVNs, this was not possible on the defaults of this pathway. Here is the code in the DeadDVN (#code" target="_blank" rel="nofollow noopener">etherscan.io/address/0x747C…) that specifically prohibits this. (Screenshot 1) This is called out many many times in the docs: 1. Integration Checklist — "Do" list - Last edited: 2025-11-26 (Nazreen) - Content: "Do: … Use more than one DVN for each production pathway instead of relying on a single DVN." - File: v2/tools/integration-checklist.mdx:244 - URL: #set-security-and-executor-configurations-on-every-pathway" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/tools/integ… 2. Integration Checklist — "Don't" list - Last edited: 2025-11-26 (Nazreen) - Content: "Don't: … Configure only one DVN for a pathway and treat it as production‑ready." - File: v2/tools/integration-checklist.mdx:251 - URL: #set-security-and-executor-configurations-on-every-pathway" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/tools/integ… 3. Integration Checklist — Defaults are not safe - Last edited: 2025-09-25 (Tino Martínez Molina) - Content: "Do not assume defaults are safe for production. Always check explicitly: getSendLibrary, getReceiveLibrary, and getConfig. If these resolve to defaults, confirm whether the defaults are valid for the intended pathway. Unintentional fallbacks to defaults are a common cause of blocked or failing pathways." - File: v2/tools/integration-checklist.mdx:126-128 - URL: #explicitly-set-message-libraries" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/tools/integ… 4. Integration Checklist — Default fallback warning - Last edited: 2026-02-26 (migration; same wording predates it) - Content: "Warning: If no configuration is set, the OApp will fallback to the default settings set by LayerZero Labs." - File: v2/tools/integration-checklist.mdx:222-238 - URL: #set-security-and-executor-configurations-on-every-pathway" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/tools/integ… 5. ONFT Quickstart — Production guidance - Last edited: 2025-02-20 (Radek Sienkiewicz) - Content: "DVN Settings: Use multiple DVNs in production to ensure message verification is robust." - File: v2/developers/evm/onft/quickstart.mdx:700 - URL: #security-considerations" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/developers/… 6. ONFT Quickstart — Strong recommendation to configure - Last edited: 2025-03-10 (Radek Sienkiewicz) - Content: "We strongly recommend reviewing these settings carefully and configuring your security stack according to your needs and preferences." - File: v2/developers/evm/onft/quickstart.mdx:366 - URL: #configure-the-onft" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/developers/… 7. Starknet FAQ — "Should I use multiple DVNs?" - Last edited: 2026-01-21 (Nazreen) - Content: ▎ Should I use multiple DVNs? ▎ Recommended for production. Multiple DVNs provide: ▎ - Increased security (multiple independent verifiers) ▎ - Resilience (no single point of failure) ▎ - Trust minimization - File: v2/developers/starknet/troubleshooting/faq.mdx:290-296 - URL: #should-i-use-multiple-dvns" target="_blank" rel="nofollow noopener">docs.layerzero.network/v2/developers/… Here are the exact recommendations we gave KelpDAO when asked about DVNs (typically 2/3) (Screenshot 2) Other LayerZero applications speaking on exactly what is advised by the team x.com/mitchellftracy… x.com/jasperflux/sta… For how much volume was actually configured on 1/1 here is the exact data. (Screenshot 3) We will publish a complete post-mortem as soon as the external security firms have completed it.

@KelpDAO @Zedzies @chainlink The right move before rsETH plans its recovery and restarts

After the recent LayerZero exploit, we are taking steps to ensure rsETH is fully secure, which is why we are migrating to @chainlink CCIP. From the April 18 incident, it is clear that LayerZero's own infrastructure was exploited, resulting in $300M in losses across DeFi. Independent reports from SEAL 911, Chainalysis, and other major leading security researchers all point to the same origin. There are questions that the ecosystem deserves answers to. And we are ensuring rsETH is secured by infrastructure that doesn't leave these questions open. That’s why we’re setting the record straight.

@PrimordialAA Tweet sounds as reliable as your configuration.. Dune literally posted a number on how many protocols use the 1/1 dvn! How are you guys writing these comms, with a free chatGPT tool?

I’ve been asking myself why has it taken me so long to write this? Ultimately I still carry a huge amount of cognitive dissonance here. In my mind LayerZero the protocol was like Gnosis Safe and the application was setting their config, and who the )@(!$ would secure billions in TVL on a 1/1? I even tweeted about it, literally 0, I would have bet almost anything on that because almost every major application we helped setup their configs. Someone then going and manually changing that to a 1/1 was outside of the realm of possibility for me. I was wrong. It’s easy to sit back and say ‘it’s just a protocol we have no control over how people use it’ but we have the opportunity to be better. There was a conversation this week speaking to a customer and they just… screamed at me, at the top of their lungs, and swore for a solid ~3-5 minutes straight. We had implemented additional security measures of forcing a more stringent RPC quorum and forcing every chain to provide multiple RPCs and we had done it without telling them and it !)@$d with their business, which frankly is a deadly sin. We had messed with their business and they said communication wise we were completely blowing this. They were completely right. This is something I care about a ton, it is both the result of a huge portion of my life and something that I fundamentally believe in. I literally gifted a copy of Unreasonable Hospitality to every single manager in the company. The entire point of what we’ve built is to enable others to build on top of it, it is to provide a protocol and a platform for people to build on, and we’ve been failing some of our largest customers. The past two weeks have been unbelievably miserable. I’m incredibly grateful for all of the applications who have worked with us over the past 2 weeks, for @zeroshadow_io who has spent endless cycles with us tracking and seizing millions in attacker funds which will be returned to the rsETH team, and for all of the parties who brought together DefiUnited. Particularly @aave for leading and @MikeSilagadze for pushing everyone to get their !@)($ together and sort things out as quickly as possible, and putting himself in the frontline of acquisition talks and everything else to try to get to a solution quickly. @LayerZero_Core is one of the most critical pieces of infrastructure in the industry, the LayerZero protocol has earned the trust of the largest and most important asset issuers in the space. We will do better and we will make the industry better for it. My entire focus over the past 2 weeks has singularly been working with applications to harden their setup, building tooling to assist in tracking and freezing hacker funds, and the rsETH recovery efforts. That is going to shift now to where LayerZero Labs spends it's time and effort. The only thing this company will spend time on is how we can better serve our asset issuers and the upcoming launch of Zero.

One of the saddest things about the decimation of the Cosmos ecosystem, is the simultaneous destruction of IBC. The Inter-Blockchain Communication (IBC) protocol was once the top bridge by volume, for transferring tokens across chains. Now, it does less volume in a month, than many bridges do in a couple of hours. There's no reason for any chain to connect via IBC any more. Most of the recent chains, built on the Cosmos SDK, have chosen not to implement IBC. Sad times.

@KelpDAO Good looks like the last part hints towards exploring CCIP 🙂‍↕️

On April 18, LayerZero's hosted infrastructure was exploited to forge a cross-chain message, draining 116,500 rsETH from the bridging adapter. Our core onchain and offchain infrastructure was not affected. As an interim security measure while we investigate a more secure cross-chain infrastructure, Kelp completed a full hardening pass across its current bridging infrastructure to prevent similar attacks. As of April 29, that work is done. What follows documents what changed and why it matters 🧵

@jasmineleee_ True… They did share an update on the figures, but once again, they inflated the number by mixing contributions with collateral (Lz can withdraw that 5k after things stabilise) .

@NullValidator Kelp raised funds, Aave coordinated Fair to ask what’s LZ contributing beyond the infra side explanation?

Kelp has been raising funds, Aave has been coordinating, partners have been pitching in (expect Lz). It’s not an easy recovery path, but a week since the exploit, and honestly, compared to the time I lost a lot of money on Terra, I have some hope here.

@Big_tagg Everyone’s story arc comes to light on Twitter

Twitter is such a goated app, it feels like a psych ward with no staff

@josefabregab @SuiNetwork Meanwhile rest of the DeFi creators posting on the topic for free

There is no way @SuiNetwork is really paying for this shit lmao

@llamaonthebrink Kelp gave 70% of their treasury right?

Pretty wild that KelpDAO and Layerzero are basically contributing less than most of the entities involved in the recovery even though they are responsible for the exploit AaveDAO is pretty much hugging the lions share of the loss through treasury + credit facility

Anyone can start a Kickstarter and ask for donations, not force them. I think it’s acceptable. Doing this before closing the recovery gap would be poor, but they probably don’t need this fund to close it; it will likely be used as an insurance policy for the future or to cover what remains.

Yeah I've got mixed feelings about public donations tbh. Before making this address available for the public, I would've loved: - disclosure on the amount from Ethena, LayerZero, Aave DAO/Labs (not stani), Frax, Ink & Tydro, as well as fucking Kelp who, to this day, haven't committed anything - more partners to come in (that we know will but are waiting for something) Just like with people that lose everything after a hack and proceed to posting their public address here to ask their community for donations. It's a fuck up from LayerZero and Kelp with Aave as collateral damage due to risk (mis)management The people that will be affected are the users. I feel it's not fair to ask them to donate. I think pinging some power users from Aave (like Justin Sun, or something) to donate would've been a better look. I don't encourage average defi users to donate as it lets those that are responsible in this situation to wait it out and commit less than they would have done otherwise. Feels like it's the first communication misstep for this campaign that I actually enjoyed following. We'll see how it goes, but I really, really can't stress enough that before doing this, it would've been more sensible to share the undisclosed commitments from the other partners involved

@josefabregab @samoa_joes @LayerZero_Core @KelpDAO 😂😂 along with thoughts and prayers and a 10% discount on your next bridge hack

@samoa_joes @LayerZero_Core @KelpDAO LZ is happy to announce it will contribute the grand amount of 3 ETH (maybe)

This is unbelievable. How on Earth do LayerZero and Kelp have the audacity to make any requests? > @LayerZero_Core has STILL not disclosed how much they will contribute to DeFi United. > @KelpDAO hasn't even committed to contributing at all. Keep in mind that (1) these were the two responsible parties for the hack in the first place and (2) LayerZero has raised ~$300M in total. This is the epitome of shameless behavior.

@GAmitej @GoneMultichain We are getting there! Just hang in and keep moving

The hardest week of my career. And also the week I saw what this industry is truly made of. We are contributing 2,000 ETH to DeFi United. Every rsETH holder will be made whole. That was always the only acceptable outcome for me personally. To everyone who showed up, thank you. DeFi United.

@CryptoSooners @KelpDAO Aren’t these funds from their own treasury? If they token dumped they probably need cash for market making too and then the regular operations.. I have seen crashes like this before it’s easy to say they offer nothing but usually it’s not as liquid as it seems

@KelpDAO Shut down operations. You got exploited for $300M, bc of your negligence, yet contribute less than $5M. You get hacked every month, and threaten to sue protocols who announce such. You made 8 figs dumping $KERNEL during Binance TGE. Sunset the protocol before you hurt more ppl

We have been working closely with Aave to protect rsETH holders and stabilize the broader DeFi ecosystem. We are glad to share that we have reached a clear path forward. The above two mission statements have been the only things on our minds this week. As part of that commitment, we are contributing 2,000 ETH from our treasury directly to DeFi United. 71,700+ users stood up apart from DeFi partners across the board. Thank you to @aave, @EtherFi, @ethena, @Mantle_Official, @bgdlabs, @LidoFinance, @arbitrum, @inkonchain, @StaniKulechov, @The3D_, @eboadom, and everyone else who showed up. We are genuinely humbled. @aave and us are aligned on execution of the next steps. The final recovery plan, user instructions, and timing will follow shortly. DeFi United.

@KelpDAO Nice we have a number and meaningful updates.. while there’s one team just astroturfing FUD..ZERO shame zero contribution… I hope LPs sue them.. shift to ChainLink be the hell away from partners who fud u during crisis!

@defivirtus 👏 love this

been watching the rsETH recovery closely. wanted a single page that just shows what's happening on pledges, live on-chain inflows, what's left. made one: rseth.netlify.app we stand defiunited.

@Artem_Oak @KelpDAO Probably better to have a 1:1 call to understand each party’s position

Hello @KelpDAO I am working on the research piece about the current situation. So far, you have not committed publicly to allocating any portion of your treasury to the DeFi United initiative. I believe you have the right to make things right and respond before we publish it, so if you'd like to provide a statement or publish a commitment of your personal funds, you can either dm me or reply to this tweet (or post it on your account for increased visibility). For the moment, the 43,000 ETH figure you are boasting was the "pause" of your bridge that prevented further drain. This is not recovery OR a commitment of the money you've raised/earned/have. I don't want to paint you in a bad way, so please reach out. DMs open :)

@josefabregab @aave Some will try to exploit “defi united” name and make a side event.. others will whip this as a reference point to shill some random MVP… lately all the events I went to were boring.. i feel now people will get more serious about things that actually matter

@NullValidator @aave why

The last 48 hours have been very telling for DeFi. We've seen what individuals, organizations, and SPs actually care about @aave, DeFi, and users as a whole. There's twitter fingers, and there's trigger fingers. Aave Labs, BGD, EtherFi, Lido, Arbitrum, and Golem have proven to be the latter. Respect to these organizations and individuals for stepping up when it matters the most. DeFi won't ever forget.

@FoxNews lol idk why I thought of this

BREAKING: Justice Department announces it's readopting the firing squad as a means of execution