April 18 LayerZero Incident: Additional Context

On April 18, rsETH was drained from its bridging adapter through a forged cross-chain message, according to Kelp, which published this follow-up while the broader post-incident review continues. Kelp says two RPC nodes hosted by LayerZero were compromised and a simultaneous DDoS attack targeted a third, and it states that Kelp's own systems were not involved in building or operating that infrastructure. Kelp says it paused relevant contracts on Ethereum mainnet and L2s, blacklisted wallets linked to the exploiter, and engaged SEAL-911, fully mitigating a follow-up attempt to target an additional 40,000 rsETH (~$95M). Kelp also states its 1-of-1 DVN setup is the default LayerZero documents for new OFT deployments.