Interviewer: Techub News
Interviewee: Slow Fog Security Team
II. Introduction
Techub News Interview Question 1: Please define this Kelp DAO rsETH × LayerZero incident in one sentence. Is it a single point failure or a landmark event representing systemic risk in DeFi in 2026?
This is one of the most severe DeFi security incidents to date in 2026, and it is also a concentrated outbreak of systemic risk. It is not just a contract being stolen, but rather the cascading risk across the three-layer architecture of LRT (Liquidity Re-staked Token), cross-chain bridges, and lending protocols being breached simultaneously — the single-point DVN configuration failed, ultimately allowing losses to spread from Kelp to Aave, and then to multiple protocols holding rsETH.
Follow-up: If you could only give one label
It should be "the problem of the entire DeFi bullish structure". The cross-chain bridge issue is the ignition fuse, but rsETH being unconditionally accepted as collateral by protocols like Aave,
and the lending risk control not being fortified against "forged minting sources" is the result of multiple layers of trust assumptions failing at the same time.
III. Background
Techub News Interview Question 2: Was it a code vulnerability this time, or a deeper issue of trust configuration?
The fundamental problem this time is not that the code was written incorrectly. The LayerZero protocol itself has no vulnerabilities, and the algorithm logic of the rsETH contract has not been directly exploited.
What was actually breached was the trust configuration of the cross-chain verification mechanism — Kelp's rsETH OApp used a 1/1 DVN configuration on LayerZero, meaning the security of the entire cross-chain path entirely relied on a single DVN node operated by LayerZero Labs. Once this node was deceived (and not "hacked"), forged messages could pass through unhindered.
This is essentially a "single point trust" problem, rather than a "single point code vulnerability" problem.
Techub News Follow-up: In the future, if security audits only review contract code, will that be sufficient?
It is completely insufficient. This incident indicates that the audit targets must extend from "the contract code itself" to "cross-chain parameter configurations, DVN selection strategies, trust dependency chains". An audit report that only looks at Solidity code cannot tell you how resilient this protocol is at the cross-chain level.
IV. Timeline Review: T-10 Hours
Techub News Interview Question 3: When did the attacker first show signs? What happened around T-10 hours?
From on-chain behavior, the attacker conducted ample preparatory work before executing the core attack — including preparing gas funds through mixers and scouting the target links in advance. This kind of premeditated preparation rhythm is a typical characteristic of a professional attack team, rather than opportunistic actions discovered after a vulnerability.
The official announcement from LayerZero pointed out that the attacker obtained the list of RPC nodes relied upon by its DVN in advance and successfully infiltrated two nodes on independent clusters, replacing the binary files of the running op-geth. All of these preparatory actions were quietly completed before the attack was implemented.
Techub News Follow-up: Can we identify APT characteristics from this kind of prior preparation?
LayerZero attributed this attack to the Lazarus Group (TraderTraitor branch), a North Korean state-sponsored APT organization. The preparations in advance for the gas sources, using mixers to avoid on-chain traceability, and meticulously designing the attack route to "only return forged data to the target DVN IP, return normal data to other IPs, and self-destruct malicious binaries after the attack was completed" — all of these are typical operational modes of highly specialized APT organizations, far exceeding the capabilities of ordinary black hat attackers.
V. Timeline Review: T-0 Attack Occurrence
Techub News Interview Question 4: Please break down the most critical attack step: what did the black hat do, and why could that forged message pass through?
The attack path broadly consists of the following steps:
- Infiltrating the RPC infrastructure: The attacker replaced the binary files of the RPC nodes relied upon by LayerZero Labs' DVN on Unichain, enabling it to return forged on-chain state data to the DVN.
- DDoS knocking out normal RPC: A DDoS attack was launched against the uncontested normal RPC nodes, forcing DVN's requests to failover to the poisoned nodes.
- DVN confirming forged transactions: DVN based on the fake data returned by the poisoned RPC "confirmed" a transaction that had never actually occurred on-chain involving the minting/sending of rsETH.
- Endpoint executing release: After the LayerZero Endpoint accepted DVN's authentication, it triggered the rsETH OFTAdapter to release or mint rsETH on the target chain.
- Cash out: The attacker used part of the obtained rsETH as collateral to borrow blue chip assets on Aave and other lending protocols, completing the cashing out.
Techub News Follow-up 1: Is the most fatal point the LayerZero framework issue, or Kelp's configuration issue?
According to LayerZero's official statement, its protocol operates completely in line with design expectations. The problem lies in Kelp selecting a 1/1 DVN configuration —
LayerZero explicitly listed this as a "Don't" item in its integration documentation and proactively communicated best practice suggestions to Kelp before the incident. In terms of responsibility attribution, this is a risk brought about by the integration party's configuration decision, rather than a protocol layer vulnerability.
Techub News Follow-up 2: If it were switched to multiple DVNs with a multi-threshold, could this attack have been stopped?
As long as a second independent DVN is introduced as a verification party, the attacker would need to control or deceive both independent verification nodes simultaneously — this would lead to a cost that increases exponentially in terms of technology and resources. This is also why LayerZero announced afterward: its DVNs would refuse to sign for any applications still using a 1/1 configuration.
VI. Timeline Review: T+46 Minutes
Techub News Interview Question 5: From the first successful attack to Kelp's initiation of the pause mechanism, it took about 46 minutes. Is this emergency response speed fast or slow?
Compared to many security incidents where responses take several hours, 46 minutes is not too slow in the industry. However, for on-chain attacks, this time window is still enough to complete the transfer, collateralization, and borrowing of large assets. The issue with DeFi is that all operations are completed within block intervals, and human intervention cannot outpace automated attack scripts.
Techub News Follow-up: Is a truly useful mechanism for the future on-chain automatic circuit breaker?
Yes. Post-incident human response can only mitigate damages; only automated on-chain defense mechanisms can stop events within the first few minutes — such as abnormal minting volume alerts, large cross-chain transaction speed limits, Oracle deviation-triggered automatic pauses. This incident should become an important node in the industry's push for "on-chain risk control automation".
VII. Timeline Review: The Foiled Second Wave of Attacks
Techub News Interview Question 6: The attackers made several attempts to continue after that, but did not succeed. What does this indicate?
This indicates that the attacker's target was not $290 million, but rather to empty the entire cross-chain availability of rsETH. Subsequent transactions being reverted indicates that Kelp's pause mechanism was effective at the last moment, preventing potentially greater losses.
Follow-up: If the project team had been 10-20 minutes slower, would the scale of losses have significantly increased?
Very likely. The attacker would have had an operating window as long as the DVN was not repaired, and the timing of the pause mechanism directly determines the loss ceiling. The $290 million already represents a tremendous damage, but from the attacker's behavioral pattern, if they had not been interrupted, the figure would have been even higher.
VIII. Timeline Review: Aave Dragged Down as an Innocent Bystander
Techub News Interview Question 7: After stealing, why did the attacker also "drag Aave down"? How did this "pit" occur?
The lending protocol cannot distinguish "rsETH minted through normal paths" from "rsETH minted through forged cross-chain messages" on-chain — for Aave, all it sees is a standard ERC-20 token and price data on the chain. The attacker deposited the abnormally obtained rsETH into Aave as collateral, borrowed high liquidity assets such as ETH, and then exited, leaving behind bad debts that cannot cover the loans.
Techub News Follow-up 1: Does this expose Aave's risk control issue, or is it DeFi's excessive trust in "external asset authenticity"?
Both, but fundamentally the latter. The risk control parameters of lending protocols are typically set based on the historical volatility and market depth of assets, and cannot perceive "whether the issuance source of this asset has been contaminated". This is a trust propagation issue across protocol boundaries that requires industry-level solutions, rather than mere parameter adjustments of a single protocol.
Techub News Follow-up 2: Should lending protocols redefine "high-quality collateral" in the future?
Yes. At least for the category of cross-chain synthetic assets, there is a fundamental gap between "can be priced on-chain" and "truly high-quality collateral".
In the future, mechanisms such as cross-chain source verification and issuance anomaly monitoring may need to be introduced as preconditions for lending protocols when accepting LRT-type assets.
IX. Structural Judgment: Systemic Risks of DeFi Bullishness
Techub News Interview Question 8: Is this the first time the entire risk of the "LRT + cross-chain bridge + lending protocol" bullish structure has been completely exposed?
Yes, this is the most intuitive demonstration of composite risks in DeFi to date. In the past, we discussed "the bug of a specific protocol"; this time it has been revealed: when multiple protocols form a composite through asset dependency relationships, the failure of any link can propagate along the value flow paths to upstream and downstream, causing cascading collapses.
Techub News Follow-up: Can we say "DeFi appears decentralized, but fundamentally relies on a few highly centralized verification points"?
This judgment is quite accurate. The core issue of this incident is precisely that Kelp placed the security of the entire cross-chain path entirely dependent on a single DVN operated by LayerZero Labs, which in turn relies on a few RPC nodes — this is a very short trust chain. "Decentralized protocols" actually have extremely centralized trust assumptions at some key stages, and these assumptions are often buried in the documentation rather than appearing on the user interface.
X. Technical Deep Dive: What Exactly is DVN
Techub News Interview Question 9: Please explain DVN in the most straightforward way, and why does a 1/1 configuration become a fatal vulnerability?
DVN can be understood as the "notary" for cross-chain messages. When a user wants to transfer assets from Chain A to Chain B, LayerZero does not directly trust the state of Chain A, but requires the DVN (decentralized verification network) to independently verify "this transaction did indeed occur on Chain A," and then proceed to release it on Chain B.
A 1/1 configuration means: only one notary has been hired, and their word is the final judgment. Once this notary is deceived, bribed, or provided with false information, the entire verification becomes meaningless — there is no second independent voice to say "wait a minute, what I see is different". This is the essence of single point failure.
XI. Technical Deep Dive: Why Audits Alone Are Not Enough
Techub News Interview Question 10: Many projects claim to have undergone audits. Why can such a major incident still occur after auditing?
The core of traditional security audits is: checking whether the code logic operates as expected and whether there are known vulnerability patterns. However, this time the problem occurred outside of the code — it occurred at the "operational parameter configuration after deployment": who verifies, how many validators are needed, and what happens if the validator fails.
The industry needs to shift from "code audits" to "system audits," which should include: cross-chain dependency configuration audits, governance authority audits, critical infrastructure dependency assessments, and most importantly — "if a certain external component fails, what will happen at worst" stress tests. Follow-up 1: Should "configuration audits" be listed as a mandatory item in the future?
I believe so. Especially for cross-chain protocols and projects using cross-chain infrastructures like LayerZero and Wormhole, DVN configuration and executor configuration parameters should be included in formal audit scopes, and the security assumptions and worst-case scenarios of the current configurations should be clearly disclosed in the reports.
XII. Slow Fog Perspective: Tracking, Loss Prevention, and Industry Collaboration
Techub News Interview Question 11: From the perspective of Slow Fog, what will be done immediately after a major attack occurs?
Typically, the following directions are synchronized:
On-chain traceability and black hat profiling: track fund flows, identify the attacker's on-chain identity traits, historical behaviors, source of funds (whether it has gone through a mixer and which mixer), and establish an attacker profile.
Exchange Coordination: Send asset alerts to major centralized exchanges, requesting monitoring and freezing of the involved black hat addresses to prevent the attacker from cashing out through KYC channels.
Risk Alerts: Push risk address lists to DeFi protocols, wallets, and other ecosystem participants to assist in cutting off the attacker's subsequent operational paths.
White Hat Negotiation Window: In some cases, establish communication channels with the attacker, offering reasonable "bounty retention" conditions to promote partial return of funds.
Follow-up: Is the probability of truly recovering funds that have already gone through mixer preprocessing high?
Frankly, if it is operated by attackers of Lazarus Group level, the possibility of completely recovering on-chain funds is extremely low. They have developed processes for fund splitting and mixing. At this stage, the industry's most realistic effort direction is to establish faster cross-exchange asset freezing cooperation mechanisms, and promote more jurisdictions to have enforcement interfaces for on-chain evidence — this is currently the weakest link, and technical capability is no longer the main bottleneck.
XIII. Ordinary User Perspective: Should We Still Dare to Participate in DeFi?
Techub News Interview Question 12: For ordinary users witnessing this incident, the most direct question is: Can we still dare to participate in DeFi now?
DeFi can still be participated in, but risk awareness and participation methods need to be adjusted. The core advice is:
Control positions; do not bet large amounts of assets on highly complex products like "cross-chain + re-staking + lending" — the more layers there are, the risks at each layer accumulate rather than offset.
Prioritize transparency; choose protocols that regularly disclose security reports, governance authority and other information, rather than just looking at "annualized rates."
Understand what assets you hold; rsETH is not ETH, it is a cross-chain synthetic asset, and its value relies on the normal operation of an entire trust chain.
Techub News Follow-up 1: Should ordinary people particularly avoid "protocols that are too complex to understand"?
This is a very good self-protection principle. If you cannot clearly explain in one sentence "where my assets are stored, who is safeguarding them, and what will happen if a certain link goes wrong", then this risk should not occupy a significant proportion in your position.
Techub News Follow-up 2: Should users upgrade from "is there an audit" to more specific questions in the future?
Yes. "Is there an audit" is the standard of 2020; today at least you should ask: does the audit cover cross-chain configuration? How many DVNs are selected? What is the governance multisig configuration (e.g., 2 - of - 3), and who holds them? This information should be standard disclosures of the protocol, rather than hidden information that users have to dig out in the documentation.
XIV. AI Era: Can DeFi Still Exist in the Future?
Techub News Interview Question 13: In the AI era, does DeFi still have a future?
The future of DeFi not only exists, but it may also achieve a true upgrade of safety infrastructure in the AI era. But this future does not belong to protocols that still attract users through "complex yield structures", but rather to those that first introduce the following capabilities:
- AI-driven real-time on-chain risk control: automatically identifying abnormal minting, abnormal fund flows, and cascading risk signals across protocols.
- On-chain insurance and automatic compensation mechanisms: shifting security assurance from "post-incident accountability" to "in-situ coverage".
- Smart risk agents: continuously monitoring the risk exposure of ordinary users and automatically adjusting positions or exiting when thresholds are triggered.
Techub News Follow-up 1: Will AI make attacks faster?
Yes. AI can be used to automatically scan for on-chain configuration vulnerabilities, generate optimal attack paths, and expedite reconnaissance processes for off-chain infrastructure infiltration. Both offense and defense will be accelerated by AI, meaning defensive parties can no longer rely on "human discovery" as the last line of defense.
Techub News Follow-up 2: Will AI force the industry to shift security from being a "cost-centered" aspect to a "core product capability"?
This is the most anticipated structural change. In the past, security investment was considered a "forced compliance cost"; in the future, when users start regarding "security transparency" and "AI risk control capabilities" as core metrics for choosing protocols, security will transform into a differentiating competitive force. This incident has accelerated this change.
XIV. Closing Sentences
Techub News Interview Question 14: Please send a sentence each for ordinary users, for entrepreneurs, and for the industry as a whole.
- To ordinary users: Do not treat cross-chain synthetic assets as risk-free assets — every percentage point of extra yield you receive is supported by trust assumptions you cannot see.
- To entrepreneurs: The security budget is not an additional option after the product launch; it is the prerequisite for your product's survival in the real market.
- To the industry: DeFi is not dead; what we need is not more complex yield mechanisms, but more honest risk disclosures.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
