LayerZero blames victims for $292 million hack, but apologizes as clients leave
After being called out for weeks and seeing major clients switch to competing platforms, the LayerZero team has issued an "overdue apology," taking responsibility for a mistake that helped enable the biggest crypto hack this year.
However, the team behind the protocol that powers a so-called blockchain bridge used to help blockchains communicate didn't mention Kelp DAO, which lost around $292 million in crypto assets in an exploit on April 19th due to LayerZero's mistake.
"We believe developers should choose their own security configurations, but we made a mistake by allowing our DVN [decentralized verifier network used to verify the integrity of cross-chain messages] to act as a 1/1 DVN for high-value transactions," the team said, admitting that they created a risk they "simply didn't see" and saying that they "own that."
They also promised to ramp up developer education efforts and ensure that applications built on the protocol are configured safely.
As reported by Cybernews, right after the exploit, LayerZero said that the attack was possible due to Kelp's single-DVN setup, while the industry best practice is to configure a multi-DVN setup.
Kelp then responded to LayerZero's accusations that the hack was enabled by its DVN's poor configuration.
While the teams were fighting and efforts to recover losses were underway, the decentralized finance industry tried to prevent contagion. Some major LayerZero clients, including Kelp, moved to other protocols, taking hundreds of millions worth of crypto assets with them.
Now, LayerZero says it has done "a terrible job" of communication over the past three weeks and claims that its DVN no longer supports 1/1 DVN configurations, while other improvements to its systems are also being implemented.
Meanwhile, commenters online were skeptical of this pivot.
"Bad job? You tried to cover it up, and only after being called out a thousand times, you decided to pivot and apologize," @jordan reacted, while @crypto_fruit claimed that LayerZero destroyed its reputation "completely."
Unlock more exclusive Cybernews content on YouTube.
