Author: Gu Yu, ChainCatcher
More than 40 hours after the hack, the chain reaction triggered by Kelp DAO continues to ferment, with more and more well-known projects such as Aave, LayerZero, and Arbitrum being dragged in, even reaching the point where some popular narratives are being sentenced to death.
Prominent KOL Feng Wuxiang stated on platform X that only ETH is safe now, and ARB has also authorized the freezing and transfer of customer assets. No L2 is a real L2 anymore. L2 rose with Arbitrum and will also fall with Arbitrum.
Another prominent KOL, Lanhu, said that the biggest loser in this Kelp incident is not Aave, nor Kelp, but LayerZero, but it is too short-sighted to see the essence of the entire incident. The essence of this incident is not disproving L2 (fake L2s aside), but disproving cross-chain bridges.
More and more extreme views are appearing in the court of public opinion, with the parties involved arguing and blaming each other, making the Kelp DAO hack a typical window to observe the division of responsibility for security incidents and the conflict between pragmatism and technological fundamentalism.
I. L0 Disproved? Cross-Chain Bridges Become the Biggest Loser
The key node of the incident was the detailed report on the hacker attack released by LayerZero yesterday, which preliminarily judged the attacker to be the North Korean-backed Lazarus Group. The attack was carried out by poisoning the downstream RPC infrastructure relied upon by its decentralized verification network (DVN). The attacker controlled some RPC nodes and coordinated with a DDoS attack to induce the system to switch to malicious nodes, thereby forging cross-chain transactions.
"The use of compromised nodes to poison attack RPC infrastructure, combined with DDoS attacks on unaffected RPCs to force failover, is a very sophisticated method. This is essentially a form of infrastructure warfare," said Samuel Tse, Head of Investments & Partnerships at Animoca Brands.
At the end of the report, LayerZero stated that the protocol operated entirely as expected throughout the incident. No vulnerabilities were found in the protocol. The core feature of the LayerZero architecture is modular security, and in this case, it perfectly achieved its intended goal, isolating the entire attack within a single application—zero risk of contagion to the entire system, and no other OFT or OApp was affected.
This complete absolution of their own responsibility became the fuse that ignited a huge backlash in public opinion, with many well-known industry figures dissatisfied with LayerZero's performance in the incident.
"L0 absolves itself cleanly; the entire article shifts all the blame to KelpDAO's configuration error, claiming they themselves had no problems at all. Amazing. May I ask, why is a 1/1 configuration allowed? Why could the internal RPC list be obtained by the attacker? Why did the failover logic, after the DDoS, directly trust the poisoned RPC without stopping verification or doing even the slightest thing?"反问ed知名行业研究员 CM.
"This deliberate evasion makes me very uncomfortable. The statement clearly says 'the protocol operated entirely as expected.' The attack is described as RPC nodes being compromised and RPC poisoning. But RPC poisoning isn't quite that; their own infrastructure was invaded and compromised. Given that the statement doesn't explain how the intrusion happened, I won't be in a hurry to re-enable bridging," said知名 DeFi 开发者 banteg.
Kelp DAO官方也随之发声,表示导致此次攻击的单验证器(1/1)配置并非其无视建议的选择,而是 LayerZero 官方指南中的默认设置,且被攻击者利用的验证器网络(DVN)是 LayerZero 自有的基础设施.
According to Dune's analysis, among the 2665 OApp contracts based on LayerZero, 47% use a 1/1 DVN configuration, which is a single verification mechanism, drastically expanding the industry's risk.
What is more frightening than the problem itself is that the parties involved do not admit their mistakes and avoid them. LayerZero, as the top player in cross-chain communication and the Layer0 narrative, has hundreds of crypto projects using its cross-chain infrastructure to bridge tokens and assets across different chains. If it continues to maintain an arrogant attitude, it will inevitably further affect the industry's confidence in it.
Public opinion generally believes that although LayerZero was not directly hacked, it suffered the greatest reputational damage—it must pay the price for "allowing weak configurations," otherwise the cross-chain narrative will collapse.
In other words, LayerZero not only needs to propose clear technical improvement measures but also needs to take on more responsibility in the asset compensation plan.
II. Is Layer2 Dead? Arbitrum's Extraordinary Freeze
The discussion about Layer2 stems from Arbitrum's freezing action. At noon today, the Arbitrum Security Council announced that it had taken emergency action to rescue 30,766 ETH stored in an Arbitrum One address by the hacker, currently worth $71 million.
Arbitrum also stated that after extensive technical investigation and deliberation, the Security Council identified and executed a technical solution to move the funds to a secure location without affecting any other chain state or Arbitrum users. The address originally holding the funds can no longer access them; only the Arbitrum governing body can take further action to transfer these funds, which will be coordinated with relevant parties.
According to interpretations by industry insiders, the Arbitrum Security Council used a privileged state override transaction type (part of ArbOS but basically never used before), making it so the attacker's private key could still sign transactions, but the ETH at that address was transferred by the chain itself.
This special transaction type completely bypassed the attacker's private key; only the chain itself (via the sequencer / ArbOS upgrade path, controlled by the Arbitrum Security Council) could inject it.
It is reported that the Arbitrum Security Council consists of 12 individuals elected by the Arbitrum DAO, and any decision requires the consent of 9/12 of them.
This caused a huge stir. Previously, it was believed that Arbitrum, as a representative Layer2, did not have the ability or authority to handle users' ETH assets, as this would violate the decentralized spirit of blockchain.
In past hacking incidents, USDT and USDCs stolen by hackers could often be frozen immediately by Tether and Circle to reduce user losses. ETH, as a native on-chain asset, has never been frozen and transferred by the chain itself in history, which is beyond the expectations of most users.
Many views support Arbitrum's approach, such as "All companies, banks, and formal financial institutions will eventually adopt a secondary architecture. Operating like a centralized entity at critical moments is not a flaw but an advantage." But this is not the case for more technical purists.
"No private key needed, no authorization needed, direct transfer." In the view of many, Arbitrum's operation this time has redefined the degree of decentralization of Layer2, making them feel insecure on Layer2.
Lanhu直言, this incident has directly touched the core ideological red line of DeFi: "Not Your keys, not your coins". This incident returns to the classic crypto dilemma: pragmatic security vs. fully decentralized security.
Conclusion
When LayerZero says "the protocol operated entirely as expected," it preserves technical correctness but loses public opinion and trust; when Arbitrum uses a privileged transaction to transfer $71 million worth of ETH, it saves user funds but deals a heavy blow to the decentralization narrative of Layer2.
The Kelp hack storm has pushed two of the hottest narratives onto the judgment stage at the same time: Are cross-chain bridges infrastructure or risk amplifiers? Is Layer2 a reliable scaling solution for Ethereum, or a secondary bank in decentralized clothing?
LayerZero was compromised due to its single validator node mechanism, and Arbitrum used a centralized special voting mechanism to recover losses for LayerZero and Kelp DAO. This forms an extremely ironic closed loop: a protocol that prides itself on decentralization collapses due to its "single point of failure"; ultimately, it has to rely on the "centralized privilege" of another protocol to conclude.
It forces the entire industry to face a question that has never been answered head-on: When the ideal of decentralization clashes with the real cost of security, which side are we willing to sacrifice?
The discussion of grand narratives is one focus of public opinion; the compensation plan for users is another practical focus. Even though Arbitrum recovered over $70 million through technical means, Aave still has nearly $200 million in bad debt. How should users' interests be properly maintained and protected?
In the vast majority of hacking incidents, losses in the tens of millions of dollars are devastating for protocols, and user compensation claims usually come to nothing. But this incident involves leading star projects like Aave and LayerZero, making their bad debt handling plans highly watched.
Aave today proposed two possible bad debt handling plans. The first is to socialize the loss among all rsETH holders (cross-chain sharing), with Kelp DAO performing a unified value write-down for all rsETH (mainnet + L2) (approximately 15% depeg). The second is to let only L2 rsETH holders bear all the losses, with mainnet rsETH maintaining its original value.
However, Kelp DAO and LayerZero官方 have not yet discussed their role in the compensation plan. From LayerZero's attempt to absolve itself of responsibility in the report, it is not difficult to see that the project believes that without responsibility, there is no obligation to compensate.
Nevertheless, a protocol with a valuation of billions of dollars, relied upon by hundreds of projects as underlying infrastructure, choosing "technical免责" in the face of huge losses caused by default DVN configurations is itself a huge讽刺 to the definition of "underlying infrastructure".
This is a typical prisoner's dilemma, where all parties in crisis are trying to minimize their own losses through "interest cutting" rather than repairing the industry's trust deficit through shared responsibility.
Judging from the negative impact of this incident on various parties in the industry, for the DeFi field, this will be the most dangerous prisoner's dilemma in history.
