This week, David Schwartz, the former CTO of Ripple, made a notable comment following the exploitation of the Kelp DAO rsETH bridge, which resulted in a staggering loss of around $292 million.
While he didn’t predict this exact incident, he was aware that certain conditions could lead to such vulnerabilities.
“During my assessment of various DeFi bridging systems for RLUSD,” Schwartz shared on X. “I primarily concentrated on security and risk factors. One observation I made was that many systems were well-constructed and incorporated robust mechanisms designed to guard against attacks similar to what appears to have occurred with KelpDAO.”
The Sales Approach That Compromised Security Features
Schwartz pointed out a recurring trend throughout his evaluations. Bridge providers would prominently showcase their top-tier security features but would quickly imply that these features were optional and often overlooked by most users.
“They typically suggested not utilizing the most critical security measures due to their associated convenience and operational complexity costs,” he noted. “We frequently encountered pitches emphasizing simplicity in adding more chains while implicitly assuming we wouldn’t take advantage of their best security offerings.”
“Their marketing strategy claimed they had superior security features that were user-friendly and scalable—assuming those features weren’t actually utilized,” he added.
The Incident at Kelp DAO
On April 19th, Kelp DAO detected unusual cross-chain activities related to rsETH and subsequently paused contracts across both mainnet and several Layer 2 networks. This led to approximately 116,500 rsETH being siphoned off through contract calls linked with LayerZero, amounting to about $292 million based on current valuations.
An analysis conducted by D2 Finance traced the issue back to a leak involving private keys on the source chain. This created trust problems with OApp nodes which attackers exploited for manipulating the bridge.
Schwartz proposed his theory regarding potential protocol-level failures: “I suspect part of what went wrong may be attributed to KelpDAO opting not to implement key LayerZero security features for convenience’s sake,” he remarked.
LayerZero itself provides strong security protocols including decentralized verification networks. Investigators are now probing whether Kelp DAO set up its implementation using minimalistic security configurations—specifically relying solely on LayerZero Labs as one verifier—which poses significant risks compared with more intricate yet secure alternatives available in the market.