LayerZero Labs has published a comprehensive forensic report examining the April 18 KelpDAO bridge exploit, collaborating with cybersecurity heavyweights Mandiant, CrowdStrike, and zeroShadow to reconstruct the attack. The report surfaces a previously unreported claim about how KelpDAO’s bridge was configured prior to the incident. That detail alone could reshape how the DeFi community thinks about cross-chain bridge security and the responsibilities of protocol operators who deploy on shared infrastructure.
What the Forensic Findings Reveal About the KelpDAO Breach
Before diving into the strategic implications, it helps to anchor the key facts. The investigation brought together three of the most recognized names in cybersecurity alongside LayerZero’s own internal team, a level of coordination that is uncommon for post-exploit analyses in decentralized finance. Here are the critical takeaways from the report:
- Configuration exposure: The report alleges that KelpDAO’s bridge operated with a configuration that deviated from recommended security parameters, a claim KelpDAO has not yet publicly addressed in detail.
- Multi-firm validation: Mandiant, CrowdStrike, and zeroShadow each contributed independent forensic analysis, lending the findings a degree of credibility that single-source investigations rarely achieve.
- The exploit targeted the bridge layer specifically, not the underlying LayerZero protocol, drawing a sharp line between infrastructure provider and application deployer.
- Precedent for accountability: By publishing the report publicly, LayerZero is arguably setting a new standard for how messaging layer providers respond when protocols built on top of them are compromised.
- Broader market signal: Cross-chain bridge exploits have accounted for billions in cumulative losses since 2021. This incident adds to a pattern that regulators and institutional participants are watching closely.
A Configuration Problem, Not a Protocol Flaw?
The most consequential claim in the report centers on bridge configuration. According to LayerZero’s findings, KelpDAO’s deployment did not adhere to the security settings that LayerZero’s cross-chain messaging protocol recommends for production environments. If accurate, this distinction matters enormously. It shifts the narrative from “the infrastructure failed” to “the infrastructure was misused.”
That framing is not without controversy. Critics in the DeFi security community have long argued that infrastructure providers bear some responsibility for how easily their systems can be misconfigured. A bridge protocol that allows insecure defaults, the argument goes, is designing for failure. Still, the forensic evidence presented by three independent firms will be difficult to dismiss outright.
Whether KelpDAO responds with its own technical rebuttal remains to be seen.
Why Three Cybersecurity Firms Were Brought In
Engaging Mandiant and CrowdStrike for a DeFi exploit investigation is unusual. Both firms are better known for nation-state threat intelligence and enterprise incident response than for blockchain forensics. Their involvement signals that LayerZero treated this not as a routine smart contract bug but as a potential targeted attack vector requiring traditional cybersecurity methodology.
zeroShadow, by contrast, specializes in on-chain asset tracing and crypto-native threat analysis. The combination of all three suggests the investigation spanned both on-chain and off-chain vectors. That breadth is worth noting (a distinction most post-exploit reports in DeFi fail to make). Attackers increasingly blend social engineering, compromised keys, and smart contract manipulation. Investigating only one layer misses the full picture.
Cross-Chain Bridge Security: The Recurring Vulnerability
Bridge exploits are not new. The Ronin Bridge hack in 2022 resulted in roughly $625 million in losses. Wormhole lost $320 million the same year. Nomad, Harmony Horizon, Multichain: the list is long and expensive. Each incident reinforces a structural reality that cross-chain bridges remain among the most attractive targets in decentralized finance.
What makes this particular exploit instructive is the forensic transparency. Most bridge incidents produce a brief post-mortem from the affected protocol, sometimes weeks later, often light on technical specifics. LayerZero’s decision to commission and publish a multi-firm forensic report within weeks of the exploit sets a different tempo.
| Bridge Exploit | Year | Estimated Loss | Post-Mortem Depth |
|---|---|---|---|
| Ronin Bridge | 2022 | ~$625M | Moderate, delayed |
| Wormhole | 2022 | ~$320M | Technical but limited scope |
| Nomad | 2022 | ~$190M | Community-driven analysis |
| KelpDAO (LayerZero) | 2025 | Not fully disclosed | Multi-firm forensic report with independent validation from Mandiant, CrowdStrike, and zeroShadow |
How This Shapes Protocol Accountability Going Forward
The report’s implications extend well beyond KelpDAO. By drawing a clear forensic line between its own messaging layer and the application-level configuration choices made by a deployer, LayerZero is constructing a framework for shared but differentiated responsibility. In practice, this could influence how future disputes between infrastructure providers and application builders are adjudicated, both in community governance and potentially in legal proceedings.
Regulators have been circling cross-chain infrastructure for some time. The European Union’s MiCA framework, while primarily targeting asset issuers and exchanges, has opened the door to broader scrutiny of DeFi infrastructure. And in the United States, the SEC’s enforcement-first approach has not yet targeted bridge protocols directly, but the pattern of high-profile losses makes it a question of when rather than whether.
For protocol teams deploying on shared infrastructure, the lesson is blunt: configuration choices carry liability. Default settings are not a defense if recommended parameters exist and were ignored. That principle, at least on paper, applies as much to traditional software deployment as it does to DeFi bridges.
Frequently Asked Questions
What exactly was exploited in the KelpDAO bridge incident?
The exploit targeted KelpDAO’s bridge configuration layer rather than the underlying LayerZero protocol. According to the forensic report, the bridge was operating with settings that deviated from LayerZero’s recommended security parameters, which the attacker was able to leverage.
Why did LayerZero involve traditional cybersecurity firms like Mandiant and CrowdStrike?
Bridge exploits increasingly involve both on-chain and off-chain attack vectors. Bringing in firms with deep experience in nation-state threats and enterprise incident response allowed the investigation to cover social engineering, key compromise, and infrastructure-level vulnerabilities alongside blockchain-specific analysis. It was not a typical DeFi post-mortem.
Does this report absolve LayerZero of responsibility?
The report draws a technical distinction between the messaging protocol and the application-level deployment. Whether that distinction holds up under broader scrutiny depends on how the community and, eventually, regulators interpret the relationship between infrastructure providers and the protocols that build on them.
What should other DeFi protocols take away from this?
Configuration hygiene matters as much as code quality. Protocols deploying on shared infrastructure should treat recommended security parameters as mandatory baselines, not optional suggestions. The forensic trail now exists to hold deployers accountable for choices they make at the configuration level.
