Who’s to Blame for How KelpDAO’s DVN Was Set Up? KelpDAO or LayerZero?

Transcript

As I'm sure everyone is extremely aware the biggest thing of this week has been the Kelp DAO hack the bridge heist. So the the TLDR on this is it is the largest DeFi hack of 2026 so far in in one transaction an attacker drained over 100,000 RS ETH. We'll get into what RS ETH is in in a minute. Around about 300 million dollars and and 20% of the circulating supply of this of this wrapped ETH asset.

So the the layer zero bridge is what powered this RS ETH kind of asset across all of the different L2s and and you know the the attack vector and Tay you know you can you can jump in here because I know you tweeted like great job guys this is like the second large hack in a row that wasn't just a simple multi-sig takeover or or key management loss.

But but yeah this this was not a smart contract bug and was not just a simple key compromise either right which is terrifying slash exciting depending on on your position. So yeah Tay what's what's your take on like the the root cause here now that we've had a few days to to like the house down. Yeah so basically I think a lot of people and this was the same for Drift as well right they just assumed that like someone got malware or something happened the keys were stolen.

In this case it was it was actually quite a bit more complex. They did get on the infrastructure of of the layer zero and basically the whole bunch of web two systems let's call them right and these systems all work together with the various blockchains and the various blockchain data in order to assist and process the transactions that go across the chains. And so in this case rather than like compromising the key that signs the transactions they actually had kind of limited access to the systems in question. They were able to get access to I guess like the what most people are familiar with is like what we

call like an RPC endpoint or an RPC node like a geth instance. And because sort of the core layer zero it's called the DVN it's a layer zero service system that they've built but like anyone can run it this is like it's like a big open source thing. Because the DVN relies on data from the geth nodes which rely on data from the blockchain when the attackers were able to gain access to the one system they were basically able to spoof transactions and so then the next step you can imagine right like data goes in it gets processed it gets verified all

this stuff happens if it's all good it goes to the next step and then that system is the one that actually like signs the transactions. And so instead of like It's worth it's worth pointing out here right cuz I think this is this is an interesting kind of like unspoken but very well known thing in like you know crypto engineering security or whatever that like what the RPCs say right like the RPC is a computer that's telling you what's happening what like it's translating what's happening on the blockchain you you know you have the blockchain there to like protect you from transactions going wrong right like the blockchain

has to validate a transaction but the RPC is like this thing that sits in between it that says here's what's happened or here's what's going to happen and if you have control of that you can trick people into thinking that the blockchain's doing something that it's not is that is that fair to say? Exactly and so that's what happened here is that the they basically like spoofed a transaction that didn't actually exist on the origin blockchain and so the rest of the system I think people got upset cuz the pose more than that they released like said the rest of the system acted as intended but technically speaking Classic response to losing

this is intended guys this is exactly what >> Technically speaking it did its job properly it was not compromised etc. but because it was acting on bad information it signed this transaction that ultimately went on the Ethereum blockchain for 116,000 RS ETH even though that had not been bridged on the origin chain right because the whole point of this is like if you in order to get a transaction out here you have to get it in here right and if this doesn't exist then you shouldn't have output.

But in this case and why this is a hack and a theft is because they were able to basically get in the middle of the flow trick the system spoof some transactions and steal that money which was a lot of money like a lot of money and it actually was almost more money because once they stole that money they then well Ken you have to explain it cuz I actually don't understand this part. They have the RS ETH they go to compound they go to Aave they go to Kyber they swap it for ETH or they take out loans as well.

>> No so they so yeah I can I can speak to to this part yeah. I'm like probably partially responsible for some of this I don't know >> looped the money. Yeah they >> [laughter] >> look there's there's there's a couple of there's a couple of things right that they they are like this looping game we we feel like we've been sidelined for it right so so uh the the ETH yield ecosystem right is very complex there are a bunch of assets that are essentially like tokenized versions of what would in tradfi be a structured

product right like we're going to you know make illiquid things more liquid by like wrapping them up and and putting them in places and the the critical thing here is that RS ETH for reasons of looping for reasons of like leverage of letting people leverage their staked ETH positions and then their you know various derivatives of staked ETH was added to Aave. And you can use RS ETH and and this is another kind of dangerous uh let's call it assumption right you can use RS ETH to borrow

WETH which is wrapped ETH um from Aave to the tune of about 90% LTV right so you know the the value of this RS ETH was was then you know the the kind of contagion compounded because you were able to basically take this RS ETH that that you minted out of nowhere and and essentially use it to borrow real ETH and then take that ETH and go and swap it on ThorChain into Bitcoin or or whatever. So so personally I woke up cuz I'm in Australia

and this had happened at like I want to say about 5:00 a.m. and so it was like 6:00 a.m. and I wake up and I'm in a bunch of group chats and it was just chaos. People were like Aave's dead Aave's not dead it's totally fine the umbrella's blown up and like I know Aave really well and I was like what the [ __ ] is the umbrella like what what are we talking like I didn't know where there were umbrellas involved in this process but so I did I did an Aave loan that is half WETH half BTC and I went there and I was like let's see if I can withdraw and the total liquidity available to withdraw in

the core WETH market was .05 WETH so I was like all right well let's the others play that. >> [laughter] >> That's kind of it for me so yeah so Odysseus what's here what's what's your take on this you have you have some hot takes on any of the so far. Yeah yeah. So far we're so far we're at like layer zero bridge DVN sign incorrect message sign you know a message that that was a lie signed to mint a bunch of this derivative version of ETH that is available on Aave

for people to use to borrow after you go straight to Aave and and not just Aave Compound and anywhere else where this RS ETH asset was listed max borrows everything and that's where we are. This is this is now you know whatever it was 6:00 a.m. Saturday for me so like Friday night US time I guess. Oh no oh wow. Yes all right yes. was turning into a hero. He was like, nah. Nah. I don't know.

>> Luca, I have some questions for you. What what is like I'm sure you guys in abstract land were were kind of scrambling to work out what what if any downstream consequences there were for you guys. What's the third order ETH taking derivative ecosystem like on abstract? Cuz we it's kind of a little bit of a catch-22. We were so consumer focused that we didn't work very hard in prioritizing DeFi. It ended up biting us in the butt because like a lot of the liquidity and the provisions just on a chain like kind of required DeFi.

But the beauty about I think some of our ramifications was there really wasn't many because we never had those integrations in place and we didn't really prioritize them until recently. We did shut down and just kind of froze the bridges on the Pangolin side. There was a lot of liquidity across many different chains on Pangolin and so we halted it. Um and uh and then just internally I think like we're of the guys that Dude, you're seeing a hack every deck and there has there there has to be some sort of intelligence here that is giving these guys an edge that is like allowing these things to be easier. Obviously the Mythos scare a couple you know a week

ago. And so I think like the whole team over there is just on red alert on like system and processes for like if something were to happen like what are we going to do and like let's not deliberate about it, right? Like if five different code reds the the action is there. Like there shouldn't be a deliberation. There should just be action. So I think we had the We're we're we're trying to be proactive and just addressing like where the world is going. Uh and tentatively you know we just on the on the layer zero side pause the bridges. I I do want to just chime in here because I am a layer zero maxi and just like give my piece.

>> know. That's why I'm that's why I'm curious here. You're saying that you know >> Yeah. I can I can give you guys my take. Like I think I think Bryan Pellegrino is the good guy. I mean I've never met a more higher integrity man and anytime I thought I was going to make a mistake he always guided me in the truest purest direction that any human could guide another human towards. I have so much respect for them and that entire team and I know they've gone through hell. I would take a guy that I think has the highest integrity of any man I've ever met. Sorry Kane, I love you, but this guy is you know bar none there. You know, if he says something happened the way that it did, I'm just going to take the guy at face value and I'm just going to say like

look, layer zero arguably one of the most important protocols in the space. They've done nothing but best practice up until this point. Clearly seems like there was some miscommunication and something that transpired, but like if anyone's going to trust an organization or a protocol in crypto like through and through down to like the head of the snake and just his moral integrity like it's those guys, right? And like whatever you know whatever needs to be made right if something needs to be made right, he's going to do everything in his power and he's going to make it right. And he's going to you know do whatever he needs to do to I think just you know, make sure that I think people trust the network and you know, continue to use it and you know, I I I just I

there's no man I can speak highly more highly of and I I my journey specifically like I'm not here without this guy. I I would have made a fatal mistake along the way and just his support just from the moment I met him like was just unbelievable you know, through and through. And so I'll just speak to that and I know those guys when this happened, these dudes did not sleep for days. They were cooped up in that office, you know, they're all in nobody's remote. They they were going through and through with it and you know, I'll just take this opportunity and again I'm not the most technically savvy guys so I'm not going to speak on the technicals or what I think is true or what isn't.

I can tell you guys though at least from like an EQ perspective and a heart perspective, I know they're going to do everything in their power to make >> this is an interesting point though, right? Because there were there were a lot of debates in in my group chats about how did we get here, right? Particularly when it comes to this like one-of-one EVN uh setup and and you know the the EV um role that that you know, layer zero has kind of played in in this and you know, um I like I really like Bryan as well and and uh Max and you know, I I know a few of those guys. Um they are like you know, if nothing else like top

absolute top tier uh in terms of their um kind of ground game and and you know, how they uh how they've like rolled things out and you know, just the support that they give for founders and you know, all the stuff that they've tried to do um and and I you know, I saw a lot of takes of like this is uh one of the reasons why they've been able to get so much traction um you know, is the like ease of deployment and BD and like all of these things, right? That um you know, uh maybe in in the case of like other setups, right? Would have been like more clunky and you know, uh and and harder to to roll out. Um but yeah, so so you

know, it's a really interesting question around like layer zero for me cuz I'm so old, right? Like came out of nowhere. Um you know, like they didn't exist and then all of a sudden they were everywhere and it was one of those crypto things of like mass adoption um by projects and teams that was that was really surprising. Um so so yeah. Um I know you dropped off uh Odysseus. So so Yeah, there was a coordinated attack. >> [laughter] >> Give us the lowdown on I mean there's a lot of blame games.

Let's avoid the blame games. What what have we learned from this situation? What do people like layer zero, but other people who are also doing asset issuance, who are also doing bridging, right? How do we make sure this doesn't happen again, please? >> [laughter] >> I think I think there's a lot of responsibility from a lot of different parties. You know, I'm I'm First of all, I'm going to argue that not a lot of people understand the systemic risk of bridges because you have all these IOUs sprinkled everywhere in the ecosystem.

Everything is like looped and you know, I think part of the problem is that bridges incurring systemic risk, right? Um so it's an extra fragile piece of infrastructure that we need to It's it's hard for people to grok even developers even even not familiar with the bridging space. Um you know, users It is in the name, right? Like we understand bridges are like pretty important things. You want to make sure they're structurally set. Like there's a lot of uh work that goes into making sure bridges don't collapse and kill a bunch of people. Like you know, it's it's not uh it's not like super unclear how important a bridge you know, a bridge

between two blockchains feels like a structurally critical piece of infrastructure, right? Like that we should be very afraid of um and and mindful of. Um Which we used to be back in the olden times, right? Like we were very worried about bridges when there were like three of them. Um and you know, we had we had Wormhole uh you know, the Wormhole hack and and you know, some other stuff that like really um highlighted it and then I think we just got so many chains and so many bridges and so many things that you know, at some point at least from my perspective we sort of lost sight of the criticality of bridges and and cross-chain messaging.

Mhm. I mean at the end of the day I think you know, bridges like layer zero won because what the users ended up caring about is what's the cheapest fastest way to transact. Um I don't care about trust assumptions or any of these like weird things. Um you know, layer zero moved amazingly well, I'm super fast. Um you know, ST operators. Um but at the same time I think you know, having a default config you know, uh not the most secure like a one-to-one. That was definitely a thing uh I assume at least um that's uh something that resulted from like moving fast and then it was never

uh you know, later circled back to actually uh you know, improve it, right? And then you have other the teams that integrate and they don't understand as well and maybe they don't do their due diligence as they should. Um so they you know, they also uh um take on that responsibility. Um and then I think it's interesting now everybody's talking about circuit breakers, which I think you know, would not solve the problem, but that would solve the systemic problem, right? It would protect the ecosystem from having like a bank run on Aave.

Which is what we have right now, right? Why you should be um you know, trapped in Aave in a very safe position when you had when you had nothing to do with that more risky asset. Mhm. Yeah. I have a steelman your statement Kane and then I'll actually ask you a question just in terms of like how do you underwrite it as a guy with size who probably like has money in DeFi, but I mean just to like steelman your point Kane like I remember those days, but like there's been no reason why you know, I I moving forward that we don't have um Dude, someone's playing the piano. I'm so sorry. Uh We got beer in It's sort of pan of A and A's like Uh I I'm going to rectify that soon. Uh

But I think uh I think from from my perspective um like Layer zero had a ginormous bug bounty and there was no reason not to trust and and you know, even to this day like I don't look at that you know everyone's saying like there's so many DVNs that are one of ones. Like none of those have any size and most of those don't do anything, right? Like any of the you know, nature like Layer zero bridges or you know, have DVN set up, you know, they're at least more than two signers. Like Yeah. To be frank, like I I don't think this is like obviously like any situation like this like Layer zero is going to have to have a little bit of a climb, but I think the dynamic shifted a little bit partly in beca- because

they've done such a [ __ ] great job for the last couple of you know, since they've basically been around. And like they put their money where their mouth is. Like the it's one of the biggest white hat bounties in the world like if I'm not mistaken. Like they they are challenging you to break this. Um you know, and and and I and you know, again, I'm not going to speak to our accountability. I'm on Pellegrino's side, Pellegrino mode. But I I I I would say that's probably why, you know, it's it's you know, we we have less of an onus on what these things, you know, at least the risk associated to them because you got a group that you know, you can trust through and through. At least that's my take on it.

Yeah, I mean the one of one DVN thing is is quite interesting, right? Because like you know, there are many things in crypto where it's like, "Hey, let's get people spun up quickly." Um you know, I mean like if you knew some of the things that went on like get a smart contract deployer like what it just like so many things, right? Like how dapps were hosted and we'll get there because also they're all hosted on Versel. Um Uh and and so like you know, this idea that uh one of one DVN configuration is like you know, the like proximate cause of all of this like sure, yes, right? Um but if

you want to stand up a bridge and you're bridging, you know, 10 grand on your like new project and testing it out, you know, if they were like, "Okay, in order for you to stand up a bridge, it's an 11 of 34 multi-sig with three different like like I'm sorry, but like no three-person team is going to use that technology ever and a three-person team becomes a 30 becomes a 300-person team, you know, so um I think that's a great point by the way. It's a great >> Yeah. Well, like I'm going to going to hear me regurgitate that.

>> [laughter] >> Some truth to No, but it's it's true. It's true because the way that these these sort of systems are are set up is like um the team is responsible for like their configs and like what they want and like they know their assets, they know their things. And then you have the DVN which is like the system which is going to be processing this, right? Um and the team can choose to use the Layer zero one. They can also choose to use other ones, right? Like Blockdaemon has one. There's There's all these different like DVN providers. Um and then that's where like the one of one, two of two, two of three, whatever you want to do, that's where that configuration comes from.

I I don't know what happened exactly here, but I think if you go back through the timeline, I'm going to guess that most of the people that were on one of ones were like setting up, were trying to get this going, were trying to figure it out. >> Who like who the [ __ ] thought KelpDAO Like >> KelpDAO turns up to you, right? And they're like, "Hey, we want to set up a thing." And you're like, "Yeah, sure, bro. Like go nuts, right? Like and and they've got like 50 ETH in there and then all of a sudden it's like, "Oh, no, actually >> Were you aware KelpDAO came as like a DeFi guy? Is this like a name?"

>> heard of it. I've I've heard of it. I haven't used it myself, but >> heard of it. Yeah, I've I've heard of it. Like you know, there's like there's a lot of ETH. And ETH is worth a lot of money now, right? So it doesn't take that you know, someone managed to get their hands on like, you know, 10,000 ETH. That's a lot of ETH, right? But it's actually shockingly not hard to get your hands on 10,000 ETH if you're in this like, you know, ETH derivative ecosystem where there is, you know, so much looping and and, you know, um cross collateralization and like all of these different things. Like once you get into this space, um it the systemic risk is just like

through the entire thing. If you enjoyed this segment, make sure you tune in at 4:00 p.m. Eastern every Wednesday where we have much more content like this. Multichain Advisors is an emerging technology growth firm that has helped create over $50 billion in enterprise value for more than 80 clients like Piff, MoonPay Commerce, and Wormhole. They've worked with some of the largest and most impactful companies in the space. They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market BD, and partnerships, capital markets advisory, PR, media placements, KOL activations, and more, driving execution from launch

to scale. Their results are measurable. To learn more and start building real traction today, visit multichainadv.com.