Kelp DAO Accuses LayerZero of Infrastructure Failures in $300M Exploit, Announces Migration to Chainlink CCIP

Kelp DAO Accuses LayerZero of Infrastructure Failures in $300M Exploit, Announces Migration to Chainlink CCIP Kelp DAO disputes claims that its configuration caused the $300M exploit, blaming LayerZero's infrastructure vulnerabilities. The protocol will migrate to Chainlink CCIP, citing security concerns and systemic risks in cross-chain infrastructure. Kelp DAO has announced plans to migrate its cross-chain infrastructure to Chainlink's Cross-Chain Interoperability Protocol (CCIP), while strongly disputing claims that its own configuration was responsible for the $300 million exploit linked to LayerZero. In a comprehensive post published on 5 May, Kelp detailed its position, asserting that the 18 April attack stemmed from vulnerabilities within LayerZero's infrastructure rather than any protocol-level misconfiguration as previously suggested. The protocol emphasized that its use of a 1-of-1 DVN setup was not the root cause of the vulnerability, pointing out that this configuration was widely adopted across the LayerZero ecosystem, included in default documentation, and explicitly approved in prior communications.Public data cited by Kelp indicates that nearly half of LayerZero-integrated applications operated under similar configurations, with most transactions relying on LayerZero's own DVN. The attack, according to Kelp, involved a breach of LayerZero's off-chain infrastructure, enabling attackers to manipulate RPC nodes and generate forged transaction attestations. This allowed the attackers to mint unbacked rsETH and extract funds across various DeFi protocols.Kelp responded swiftly, pausing contracts within an hour of detecting the attack and claiming to have prevented additional losses exceeding $100 million. The protocol also questioned inconsistencies in LayerZero's postmortem report, particularly its characterization of the incident as an isolated configuration issue. Kelp noted that LayerZero later restricted 1-of-1 DVN setups after the exploit, a move that contradicts earlier guidance suggesting such configurations were acceptable.The protocol raised further concerns about shared infrastructure dependencies, lack of monitoring alerts, and the exposure of RPC endpoints, arguing that these factors indicate systemic risks within LayerZero's trust model. As part of its response, Kelp confirmed it will transition to Chainlink's CCIP, citing its robust track record and security model. This move reflects a broader industry shift toward more secure cross-chain infrastructure following the exploit.Kelp reiterated its commitment to securing user funds and rebuilding trust, with a full forensic report expected at a later date. The dispute between Kelp and LayerZero highlights growing concerns about cross-chain security and the systemic risks posed by widely adopted default configurations