Over the weekend, KelpDAO got exploited for $290M in rsETH. KelpDAO uses LayerZero as their cross-chain bridge, and the LZ team wrote a post-mortem that blamed KelpDAO, and KelpDAO only, for the incident. Here's how the hack went down. Basically, the attacker compromised a subset of RPCs used by a single DVN (Decentralized Verifier Network) integrated by KelpDAO, DDoS’d the honest endpoints, then used the poisoned ones to forge a cross-chain message. Yes, KelpDAO should not have used a single DVN to secure their bridge instance. That was dumb. But do you know who runs that single DVN - the one where the RPCs were compromised? LayerZero Labs - the developers of the bridge. Clearly KelpDAO isn't the only one to blame here. My questions: 1) How did attackers get access to LayerZero Labs' RPC infra? 2) Why are single DVNs even allowed? 3) How should we think about minimum standards for cross-chain security today: number of DVNs, diversity of infra providers, or some explicit “no single point of failure” benchmark? Tough time for DeFi right now. Here is the brutal post-mortem: https://t.co/P647A4QdpQ