kelp

According to CoinDesk, after KelpDAO was attacked resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure continues to heat up, with approximately $4 billion in assets having completed or currently migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP).The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would abandon LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to achieve asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

Aave stated that the first steps of the rsETH technical recovery plan have been completed, which includes the destruction of the rsETH held by the attacker on Arbitrum. In the coming days, stakeholders will gradually replenish funds to the LayerZero OFT adapter and restart rsETH-related operations in phases.Kelp previously stated that it has completed a series of rsETH endorsement recovery steps with Aave, planning to gradually inject 117,132 rsETH from the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on the Ethereum mainnet.

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

Lido released the latest updates on the Kelp security incident, stating that the Snapshot vote regarding the EarnETH first loss protection mechanism being below the 1% threshold has reached the quorum and been approved. The losses for EarnETH users will be fully covered by the Lido Earn first loss mechanism.The rsETH held by the attacker has been liquidated, and the related stETH has been transferred to the DeFi United rescue plan. In addition, the EarnETH treasury is expected to reopen shortly after the Kelp protocol resumes operations, at which point users will be able to conduct normal deposit and withdrawal operations. Lido emphasized that during the freeze period, the EarnETH and EarnUSD treasuries continue to generate returns. Currently, EarnETH users only need to wait for the brief unfreezing process to complete, and once the funds are restored, they will be compensated according to the first loss protection mechanism.

According to The Block, the on-chain lending platform Aave has completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker as part of the previously announced recovery plan.The collateral obtained from the liquidation will be transferred to a multi-signature address "Recovery Guardian" managed by the DeFi United initiative, which is working to restore the asset backing of rsETH and compensate affected users. This process marks one of the final stages of the community's efforts to make up for the $292 million vulnerability loss.Aave previously noted that its liquidation required governance process support, specifically, Aave voted to temporarily manipulate the price of the rsETH oracle to cause losses on the attacker’s fraudulent positions. Aave stated that all adjustments will be fully restored after the liquidation is completed.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.

Kelp DAO announced that it will migrate its re-staked token rsETH to Chainlink CCIP, stating that this move is to enhance security.Previously, the cross-chain bridge built by Kelp DAO based on LayerZero was attacked on April 18, resulting in hackers stealing approximately 116,500 rsETH, involving an amount of about $292 million, and using the related assets as collateral to borrow WETH on Aave v3. Regarding the cause of the vulnerability, LayerZero previously stated that the issue stemmed from Kelp DAO using a single DVN verification path configuration instead of multiple independent verifications. Kelp DAO responded that this configuration was the default setting and that LayerZero had confirmed its security without indicating any related risks. LayerZero CEO Bryan Pellegrino subsequently denied this claim, stating that Kelp DAO had actively modified the default multi-DVN configuration. Both parties are currently still in ongoing disputes over the attribution of responsibility.

According to The Block, after experiencing a bridge attack of approximately $292 million last month, Kelp DAO decided to abandon LayerZero and instead adopt Chainlink's cross-chain infrastructure.Kelp DAO will use the Chainlink Cross-Chain Interoperability Protocol, which requires 16 independent node operators to validate cross-chain transactions, becoming the first major protocol to leave LayerZero after the attack. During the attack, the LayerZero-driven OFT bridge used a 1-of-1 single validator configuration, with 47% of LayerZero applications using the same configuration at that time. LayerZero subsequently announced the cessation of single validator configurations.Kelp DAO stated that migrating to Chainlink CCIP directly addresses the architectural vulnerabilities in the attack. rsETH will also adopt a cross-chain token standard. As part of the DeFi United rescue operation, LayerZero has donated and lent approximately 10,000 ETH to Aave.

According to Cointelegraph, the U.S. law firm Gerstein Harrow LLP has applied to the court for an injunction to prevent Arbitrum DAO from transferring frozen Ethereum assets related to the Kelp attack.The law firm claims that its clients have obtained default judgments in three cases against North Korea, totaling approximately $877 million (including punitive damages and interest), and assert a right to claim the related assets.Previously, Kelp DAO was attacked on April 18, resulting in losses of about $292 million, which is believed to be related to the North Korean hacker group Lazarus Group. Subsequently, the Arbitrum security committee urgently froze approximately 30,766 Ether (about $73 million).The incident has sparked controversy. Some community members believe that if the injunction takes effect, it will delay the return of funds to the victimized users and shift the North Korean-related debts onto secondary victims. Previously, Aave Labs had proposed to unfreeze the funds and inject them into a compensation fund to restore the damaged assets.It is worth noting that Gerstein Harrow has previously filed claims regarding assets stolen by North Korean-related hackers and frozen by cryptocurrency platforms, including the 2023 Heco Bridge incident. Industry analysts believe that this case may have a demonstrative impact on the disposal of DAO assets and the definition of cross-jurisdictional claims.

According to market news, the Arbitrum committee voted to unfreeze $71 million worth of Ethereum to mitigate the $290 million loss caused by the Kelp DAO vulnerability.

Arbitrum DAO has initiated a governance vote to release 30,766 ETH that was previously frozen, to support the aftermath plan of Kelp DAO following the attack, DeFi United.This portion of assets was frozen by the Arbitrum Security Council on April 20, valued at approximately $71.1 million, originally funds transferred by the attacker to the Arbitrum network. If the proposal passes, this will become the largest financial support in the DeFi United plan. At the beginning of the vote, 16.9 million ARB have supported the proposal, and there are currently no opposing votes. The voting will continue until May 7.

KelpDAO has announced that it has completed its committed contribution to the recovery fund and has provided 2000 ETH in treasury funds to the DeFi United recovery plan led by Aave, aimed at restoring the peg support for rsETH and promoting the system's return to normal operation.This funding is a one-time investment intended to restore rsETH to its nominal exchange rate. Following the events of April 18, DeFi United, in collaboration with multiple ecosystem participants (including Mantle, Consensys, Arbitrum, Lido Finance, LayerZero, etc.), has formulated a recovery path that includes re-capitalization of the bridging treasury, restoration of oracle functionality, and addressing funding gaps in the affected markets.Kelp stated that its investment helps accelerate the overall repair process. Kelp emphasized that the internal commitment before any public statement is that "rsETH holders will not be abandoned," and noted that this contribution is a direct manifestation of that commitment.As funds from various parties gradually come into place, the collateral support for rsETH will gradually return to normal, and the company will continue to update the community on progress.

The Lido research forum has launched a new proposal suggesting that the DAO authorize a temporary reduction of the first loss protection trigger threshold for the EarnETH treasury during the Kelp event. According to current rules, the protection mechanism of Lido Earn only triggers when the treasury loss exceeds 1% of the holdings. However, the proposal points out that if the shortage of rsETH is resolved through DeFi United, the actual loss may be less than 1%.To ensure that EarnETH users receive full compensation, the proposal suggests a one-time exception during this event, allowing the use of the first loss fund to cover losses below the 1% threshold. The current estimated residual borrowing rate loss is about 400 to 600 ETH.The proposal emphasizes that this move is a one-time arrangement for user protection, brand reputation, and business considerations, and does not change the general 1% rule. Since the rsETH event is expected to be resolved within 5 to 10 days, and the standard voting window is 7 days, the proposal also has a sense of urgency.

DeFi United announced a technical repair plan for the Kelp DAO rsETH cross-chain bridge vulnerability on Tuesday. Previously, attackers exploited a vulnerability in the LayerZero-driven Unichain to Ethereum bridge, releasing 116,500 rsETH by spoofing inbound packets, of which approximately 107,000 are currently still distributed as collateral across seven associated addresses in Aave and Compound.DeFi United stated that it has secured enough ETH commitments to restore the support for rsETH, which will be converted into rsETH in batches and injected into the bridge lock contract. LayerZero Labs pledged over 10,000 ETH on Tuesday to support the repair efforts. Regarding the liquidation of the attackers' positions, the alliance will execute controlled liquidations through Aave and Compound governance proposals, expecting to recover approximately 13,000 and 16,776 ETH, respectively.During the repair period, WETH and rsETH reserves on multiple chains will remain frozen. DeFi United also cautioned about execution risks, including governance approval progress, potential interference from attackers, and new security measures pending validation in the production environment.

KelpDAO announced on platform X that since April 18, it has been coordinating with Aave and ecological partners to advance the recovery work for rsETH holders. The initial gap of this incident was 163,200 ETH, and Kelp has currently recovered 40,300 rsETH, equivalent to about 43,000 ETH. The Arbitrum Security Committee has also secured an additional 30,700 ETH, leaving a remaining gap of approximately 89,500 ETH.Kelp stated that among the remaining gap, Mantle, Stani Kulechov, EtherFi, Lido, and Golem have publicly confirmed commitments totaling 43,500 ETH and are working with partners to formalize the relevant contributions. Kelp emphasized that rsETH holders are a priority.

Aave, in collaboration with multiple institutions, has launched the "DeFi United" rescue plan to address the approximately $292 million loss caused by the KelpDAO vulnerability attack and to prevent the spread of bad debts.The attack originated from a vulnerability in the LayerZero integration, where hackers forged uncollateralized rsETH and borrowed approximately $190 million in assets on Aave, leading to collateral distortion and triggering a bank run, causing the platform's TVL to evaporate by about $10 billion at one point.Currently, Lido Finance, EtherFi, and founder Stani Kulechov have proposed funding plans; Arbitrum has frozen some funds, but the remaining assets have been transferred through THORChain, making recovery difficult. The current focus is on joint funding to "patch the holes" and stabilize the DeFi lending system.

Lido has proposed to allocate up to 2,500 stETH (approximately $5.8 million) from the DAO to cover the asset gap of rsETH caused by the recent attack on Kelp DAO.Lido pointed out that the exploit based on LayerZero has led to insufficient rsETH reserves and triggered a chain reaction in the DeFi ecosystem, including rising interest rate pressures, a tightening lending market, and some leveraged strategies facing the risk of forced liquidation. The proposal emphasizes that these funds will only be used as part of a complete recovery plan, provided that the overall gap can be fully filled. Previously, the attack on Kelp DAO, amounting to approximately $292 million, had impacted Aave, causing bad debt issues, and its total locked value (TVL) once dropped by nearly $8 billion.

The on-chain analysis platform Santiment tweeted that six days after the Kelp event outbreak, there were obvious signs of "refugee trade" in the market.The Spark token SPK skyrocketed from $0.029 to $0.058 within 48 hours, an increase of over 100%. Meanwhile, whale transactions (over $100,000) surged from an average baseline of about 30 per day to 183 today.In contrast, the price of the AAVE token continues to decline, currently hovering around $92, even though Bitcoin had previously broken through $79,000 earlier this week.Santiment pointed out that this event did not solely cause destruction but led to a reallocation of funds— a liquidity crisis for one protocol turned into a bull market for another protocol.Note: "Refugee trade" is a metaphorical term in the crypto/DeFi space, specifically referring to the phenomenon where funds flee in large amounts from damaged or high-risk protocols, similar to refugees, and move to another protocol that is relatively safe and lower risk.