The final tranche of 20,373.72 rsETH has been sent to the rsETH OFT adapter earlier today. This closes the operational part of the rsETH recovery plan.
Tx: https://t.co/fB2HLWvggk
Seismic Testnet is live.
We built it alongside 30 financial services companies, from fintech startups, to regulated institutions, to local governments.
Two weeks ago, a forged transaction on infrastructure we trusted cost our users 116,500 rsETH.
I'm not going to pretend that doesn't stay with me. Earning users' trust takes years. Watching it get tested like this is something I wouldn't wish on anyone.
We paused the contracts. We flagged the breach. We coordinated recovery. We documented everything. And we didn't speak until we had something worth saying.
I want to thank everyone who showed up for DeFi these past two weeks. Every team that prioritized the ecosystem over everything else. That solidarity is what this industry is built on.
We have always chosen our users over the noise. But silence isn't the same as having nothing to say.
Here's what happened. Here's what the facts show.
There's 99,410 ETH in bad debt from the KelpDao exploit.
The good news? DeFi protocols have united with donations, and 90% is covered so far.
Here's a list of who's contributing:
Community Update
The past few days have been relentless. With the support of our partners, allies and community, discussions are moving in the right direction. We want to address our community directly. We are actively progressing towards a suitable resolution.
Kelp was built on the core principle that users will always come first. This has been evident in our initial actions and will continue to be reflected in the updates to come, which we aim to deliver in a way that benefits everyone.
Over the past four days, our team, alongside partners and allies, has been operating around the clock and engaging closely with all involved parties. We have made meaningful progress across several paths forward in collaboration with key ecosystem partners.
This progress is reflected in concrete actions, including measures taken by the @arbitrum Security Council to freeze stolen funds and the swift involvement of @_SEAL_Org's SEAL 911 force in the initial investigation, providing all parties with clear and impartial insight into what occurred. While not all of this is visible publicly, the work continues steadily and with substance.
At present, all our attention and efforts are directed towards safeguarding our users and strengthening the protocol. Moments like this are defining not only for us but for the broader ecosystem. We believe it is our responsibility to pursue the most appropriate outcome for our users. We are grateful for the support and collaboration we have received from partners and the wider community.
We will continue to share concrete updates through our official channels as they become available.
- Team Kelp
reminder that, regardless of *any* DVN setup, if an OFT (like weETH here) uses the default libraries, it can be rugged by a 3/5 msig controlled by LayerZero Labs alone. billions of $$ of tokens use default libraries. this is another huge hack just waiting to happen.
Tbh, for me, Kelp vs. LayerZero is a David vs. Goliath story.
LZ is a $1B FDV company.
Kelp’s valuation is ~ $20M.
That’s ~50x smaller in market terms.
So yeah, it’s easy for LZ to point fingers at Kelp – while ignoring the fact that 47% of protocols use a 1/1 DVN config.
Plus, CT keeps calling out the 1/1 DVN config, but the bridge attack would have happened with a 3:1 configuration as well. The root cause is LZ’s RPC nodes.
In the end, what matters for DeFi is that the three parties – Aave, Kelp, and LayerZero – finally start collaborating on how to overcome this crisis.
rsETH from kelpdao was the only asset with a 1-of-1 config that got exploited because it had the biggest pot that the exploiter could exit with
No other asset with large enough bridged supply had as good of an exit path for the exploiter as rsETH did - because of aave v3 market listings with ample liquidity to borrow
The exploiter was sophisticated enough to know that he will only get one shot at this and calculated the target meticulously to maximize their extractable value from the exploit
ARBITRUM RECOVERS $70.9M FROM KELPDAO EXPLOITER
The Arbitrum Security Council just removed $70.97M ETH from the KelpDAO Exploiter’s addresses. They sent it to the address 0x0000000000000000000000000000000000000DA0
North Korea stole the money and Arbitrum stole it back.
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications.
After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.
As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.
OK — Kelpdao hacker, how much you want? Let’s just talk. With KelpDAO’s help, of course. It’s simply not worth it to sacrifice both Aave and KelpDAO and let them go down over this hack. You can’t spend $300 million anyway.