A reported cross-chain exploit against Kelp DAO resulted in the release of 116,500 rsETH to an attacker after a LayerZero endpoint accepted what was treated as a valid instruction. The stolen funds were then used to borrow large sums across DeFi, including on Aave, amplifying the downstream impact.
The security issue here is a classic cross-chain trust failure. When a contract accepts remote instructions, the correctness of the message verification path becomes the system’s most important control. If that control can be spoofed, the attacker can trigger legitimate-looking asset movements without owning the underlying authority.
Defenses should focus on stronger message authentication, narrow trust assumptions, and conservative release logic. Protocols should require robust proof verification, verify source-chain origin and payload integrity, and use rate limits or delayed settlement for high-value cross-chain transfers.
Teams should also monitor for cascading effects after an initial exploit. Even when the first target is a bridge or wrapper, attackers often recycle the stolen assets into lending markets, making rapid liquidity and collateral monitoring essential.