Crypto Community Questions LayerZero's Multi-Verifier Security Model After $290M KelpDAO Exploit

LayerZero faces heavy criticism following the $290 million KelpDAO exploit, the largest DeFi hack of 2026. LayerZero attributed the attack to North Korea's Lazarus Group and claimed KelpDAO's 1-of-1 verifier configuration caused the breach, stating the protocol itself is secure. The attack involved compromised RPC infrastructure used by LayerZero's Decentralized Verifier Networks (DVNs). Attackers poisoned RPC nodes and used DDoS attacks to force failover, enabling message forgery. The crypto community widely criticized LayerZero for lacking accountability. Users argued that offering a 1-of-1 configuration represents a fundamental design flaw, not customer error. Chainlink's Zach Rynes and Yearn developer Artem K questioned whether LayerZero adequately supported this configuration, suggesting shared responsibility for the compromise. LayerZero's proposed fix—migrating to multi-DVN setups—faced significant technical criticism. Analyst The Smart Ape argued that multiple verifiers provide false security: if all independent DVNs read from the same three RPC providers (mostly clustered on AWS/GCP), poisoning those three RPCs simultaneously fools all five verifiers, mathematically collapsing to 1-of-1 redundancy. The analyst proposed that actual security requires each verifier running its own full node on different client software, hosted on different cloud providers, and peered with different Ethereum network subsets. Until verifier infrastructure topology can be audited—including RPC provider diversity, client software variety, cloud provider distribution, and regional separation—'multi-verifier' claims remain unsubstantiated marketing.