Simon

@therealOGPlague @CryptoCurb Their own DVN was hacked, so yes they were.

@CryptoCurb You realize that LayerZero wasn’t hacked right? They did, however, offer a configuration that should never have been offered.

"so you staked your ETH on the Ethereum blockchain to earn yield?" "yes, Dave" "except you didn't want your capital to be locked up so you actually staked it with a liquid staking protocol called Lido?" "that's correct, Dave" "and Lido gave you a liquid staking receipt token called stETH in return?" "yes, Dave" "and then you didn't think that was enough, so you juiced the yield even further by depositing your stETH receipt tokens into a restaking protocol called Eigenlayer?" "you are correct, Dave" "and now you didn't want to lock up your capital, so you actually restaked with a liquid restaking protocol called KelpDAO who provided you with a liquid restaking receipt token called rsETH?" "you got it, Dave" "and then that was surely not enough juice, so you then deposited your rsETH tokens into a lending protocol called AAVE so that you could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero whose security is held together by a 1/1 toothpick, which was obviously hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry" "you are 100% correct, dave" jfc.

@arbitrum Good, this is the correct decision.

The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications. After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users. As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.

@tydrohq Isolate the two highly leverage rsETH/ETH wallets mentioned previously. They're the issue here. They have to be 100% liquidated before my Weth is taken from me.

Update on the rsETH situation and path to resolution: LlamaRisk and Aave service providers have published a detailed incident report modeling two potential loss allocation scenarios. The outcome hinges on how rsETH NAV is updated across mainnet and L2s: Scenario 1: Uniform socialization across all rsETH holders: ~15.12% haircut on every rsETH token, regardless of chain. Estimated ~$123.7M in bad debt across Aave markets. Scenario 2: Losses isolated to L2 rsETH: L2 holders repriced to the adapter's 26.46% backing ratio, a 73.54% haircut. Estimated ~$230.1M in bad debt, entirely concentrated on L2s. Tydro is working towards a solution in either case including collaborating with the industry recovery group as well as other stakeholders and relevant parties in this evolving situation. More details will be available once a decision is made about rsETH NAV accounting across different networks. Please stay tuned on official channels. We appreciate your continued patience and support during these uncertain times.

@rookie_of_Ph @KelpDAO Your confusing default and recommended, but ok. If you read Layer Zero incident report, it mentions 2DVN is now required.

@simonc11 @KelpDAO from docs itself

@BoyGatorade @aave @LlamaRisk Because the hacker dumped a large amount of stolen rsETH onto mainnet

@aave @LlamaRisk Scenario 1 seems so bad. Core Aave had no issues - why punish L1 for issues on L2 chains or bridges? This would make L1 only as secure as the worse L2 connected to it. Can't imagine using defi again unless all L2s go away.

Update on rsETH incident: @LlamaRisk has published a report outlining the rsETH incident, the immediate actions taken, its impact on Aave, and potential paths forward. All service providers have been working to assess the two potential bad debt scenarios on the Aave protocol. Aave DAO service providers are also leading an effort with ecosystem participants to address any bad debt. This effort already has several indicative commitments from various parties and we are grateful for the strong support we have received so far. We will share further updates as we have them. In the meantime, the full report can be read here: governance.aave.com/t/rseth-incide…

@cityhikers @aave @LlamaRisk their claim all rsETH on mainnet is backed is also strange

@rookie_of_Ph @KelpDAO Yes it did, I suggest reading Layer Zero posts instead of Google.

@simonc11 @KelpDAO No, it did not

@rookie_of_Ph @KelpDAO The default changed yesterday.

@KelpDAO "The question of DVN configuration came up during Kelp's L2 expansion, and defaults were affirmatively confirmed as appropriate at that time." 1. show receipts 2. The default is 2/2 with google cloud/polehedra and LayerZero as the 2 DVNs

@CryptoSnooper_ Layer Zero did say it was their node.

"Two RPC nodes hosted by LayerZero were compromised" Very interesting how LayerZero didn't say it was their nodes.

@shubhashis13 @tydrohq @HypernativeLabs @inkfndhq the two rsETH/ETH supply/borrow highly leveraged wallet should take all losses

@tydrohq @HypernativeLabs No hack on Ink. No fraudulent rsETH activity. So why are all wETH suppliers locked? If the issue is 2 wallets, isolate them — don’t freeze the entire market. @inkfndhq

Overview of the last 30 hours and the current situation: The team was notified of the rsETH exploit immediately by our internal systems and @HypernativeLabs monitoring. No fraudulent assets or transactions from the attackers occurred on Ink, and no suspicious borrow activity was observed in the Tydro markets before they were paused. This is because the Ink and Kraken security teams promptly blacklisted the attackers addresses from transacting on Ink and Kraken through @FortaNetwork and froze the rsETH asset on Tydro with the help of our technical and risk service providers. The Tydro infrastructure remains secure. The vulnerability was in rsETH’s LayerZero bridge. As a result of the exploit and broader market uncertainty, several larger depositors pulled out of stablecoin markets, which has led to a temporary spike in utilization and interest rates as they evaluate market conditions. These markets remain fully collateralized despite the higher utilization. Stablecoin and BTC collateral remains unaffected. Any exposure is concentrated amongst rsETH and wETH. As of writing, there is $21M of rsETH collateral borrowing $19.36M of wETH concentrated between two highly leveraged wallets. These markets are now frozen. Tydro is working with the Ink Foundation and other stakeholders in the broader ecosystem to provide a resolution for its users, and will be sharing a further action plan to remediate losses through official channels as the situation progresses. A large part of the recovery value depends on the decisions made surrounding the NAV of rsETH on L2s vs L1. While we await further information on the situation report and recovery plan, we want to be perfectly clear: Tydro is of the opinion that the only defensible framework is an equitable socialization across all rsETH holders regardless of chain. Tydro is actively monitoring the situation and considering all available avenues, including legal, to protect users on Ink. We expect other impacted L2 communities to seek the same equitable treatment for their users. We appreciate your patience as we navigate this difficult time, please stay tuned for further updates through official channels.

@tydrohq @HypernativeLabs can the two highly leveraged rsETH/WETH wallets take all losses.

@0xWickNM @arkham not true. The attacker dumped on mainnet, Arbitrum, and no other chain.

@arkham Attacker also deposited $20m rsETH on Tydro in Ink L2 and borrowed $20m ETH

@cmdefi They state the only used DVN was their own and was hacked. This is them accepting some blame.

L0 把自己摘的干净，整篇文章把锅全都甩给KelpDAO配置失误，自己硬是一点问题没有。绝了。 请问， 为什么允许 1/1 配置存在？ 为什么内部 RPC 列表能被攻击者拿到？ 为什么 failover 逻辑在 DDoS 后直接信任被污染的 RPC，而没有直接停止验证，或者哪怕做一点点事情？

@kir_varlamov @elliptic_sats @alpha_pls And can you prove AI is the cause

@elliptic_sats @alpha_pls None of April’s hacks are novel. Every vector is a decade old. The shift is frequency - we’re seeing years of exploits compressed into days.

Crazy hack. The biggest fear I have with DeFi currently is that hackers have been give new god like powers with AI to find exploits and DeFi teams haven’t yet used AI with the same purpose to up their security/monitoring/auditing/defence. New security standards are required in a world where an individual can have 1000 agents coordinating 24/7 to create exploit strategies, and find the smallest vulnerabilities, which would have been impossible previously due to the time required. It’s on DeFi teams to convince users that they are also adapting to the new threats that exist.

@Shtihmas11 @griffgreen @KelpDAO The funds were stolen on Mainnet, so Mainnet holders should pay 100% of losses.

@griffgreen @KelpDAO L2 risks stay on L2. Don’t bail.

If @KelpDAO doesn't some how recover these funds, they have a tough decision to make. The rsETH on mainnet is fully collateralized by ETH, but the rsETH on L2's is not backed by rsETH on the mainnet side of the bridge. What is the right call?

@Hauruck9 @griffgreen @KelpDAO rsETH is still the same liquid staking token regardless of being on Mainnet, Arbitrum etc.

@griffgreen @KelpDAO The cost of additional layer 2 risk should never be carried by layer 1 users. The exposure to such risk has already be chosen by the users before the hack.

@corepl @griffgreen @KelpDAO The bridge is operated by Kelp, it's their infrastructure, so holding rsETH exposes you to their infrastructure regardles of chain.

@griffgreen @KelpDAO L2 rseth holders took additional bridge risk (most of them didnt understand it). Spilling this to L1 rseth holders, who didn't accept those risks would just bad.

@BattleJeff1 @griffgreen @KelpDAO Nice idea, though no one would be willing to buy Liquid staking tokens with yield below market average.

@griffgreen @KelpDAO rsETH L2 users lose 100% of redemtion power but still keep 100% of the reward acquiring power, + previledge of 0% fees for their future reward +X% (I would say 70%) of future fees flow to them, until 100% compensated (including the yield they are supposed to earn).

@USDT0_to Open your bridge please

As a precautionary measure, we have temporarily paused the USDT0 OFT bridging infrastructure while the rsETH incident is being investigated. We want to be clear that USDT0 has no exposure, and all USDT0 tokens remain fully backed 1:1 by USDT. We'll share updates as more information becomes available.

@Crypto_Goblinz How did they fake cross chain message from Unichain

The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today. KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway: • requiredDVNCount: 1 • requiredDVNNames: [LayerZero Labs] • optionalDVNCount: 0 • optionalDVNThreshold: 0 Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3. How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum. To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1. Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury. Baseline for any OFT/OApp with serious TVL: • Multiple required DVNs (3–4+) • Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client. • Optional DVNs + threshold on top • Sane block confirmations If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you. Anyone can verify any OApp's config on layerzeroscan.com right now. Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks. Check your configs. Stay safe out there.