A customer screamed at LayerZero CEO Bryan Pellegrino for five minutes over unannounced changes that broke their systems, capping two weeks in which the rsETH exploit traced to a 1/1 signer securing billions that Pellegrino thought impossible to configure.
Deep dive
- The rsETH/Kelp exploit traced to a manually configured 1/1 signer on LayerZero infrastructure securing billions, a configuration CEO Bryan Pellegrino deemed "outside the realm of possibility" given his team's involvement in most major deployments
- Someone manually changed the deployment to 1/1 after initial setup, a scenario LayerZero failed to monitor despite managing critical infrastructure
- In an unrelated operational failure, LayerZero pushed mandatory RPC quorum requirements across all customer deployments without notification, breaking production systems
- At least one customer spent 3-5 minutes screaming at Pellegrino about the unannounced changes, which he acknowledged as a "deadly sin" of interfering with customer business
- Pellegrino said he had given every manager a copy of "Unreasonable Hospitality" and that they've "been failing some of our largest customers"
- ZeroShadow worked with LayerZero to track and seize millions in stolen funds earmarked for return to the rsETH team
- An Aave-led DefiUnited coalition coordinated the broader response, with Mike Silagadze handling acquisition talks and pushing parties to resolve issues quickly
- Pellegrino described the past two weeks as "unbelievably miserable" and committed the company to better serving asset issuers
- LayerZero Labs will shift focus entirely to asset issuers and the upcoming Zero launch, moving away from broader application support
- The incident exposes critical operational gaps even at well-funded infrastructure companies—both in preventing insecure configurations and coordinating breaking changes with customers
Decoder
- LayerZero: Cross-chain messaging protocol enabling smart contracts on different blockchains to communicate and transfer assets
- Kelp/rsETH: Kelp is a liquid restaking platform; rsETH is its token representing restaked Ethereum
- 1/1 signer configuration: Single-key security setup with no multisig protection, considered dangerously inadequate for production systems managing significant funds
Original article
The rsETH/Kelp exploit traced to a manually configured 1/1 signer on a LayerZero deployment securing billions in TVL, a setup LayerZero Labs CEO Bryan Pellegrino called inconceivable given the team's direct involvement in configuring most major application deployments. Pellegrino also admitted LayerZero unilaterally imposed stricter RPC quorum requirements across customer deployments without notification, disrupting operations and drawing sharp criticism from at least one affected team. ZeroShadow tracked and seized millions in attacker funds earmarked for return to the rsETH team, while an Aave-led DefiUnited coalition coordinated the broader response with Mike Silagadze handling acquisition talks. Pellegrino announced LayerZero Labs will now concentrate entirely on serving asset issuers and shipping the Zero launch.
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi