Ripple CTO: Kelp DAO Exploit Reflects Bridge Security Trade-Offs

David Schwartz, CTO Emeritus at Ripple, identified a pattern in bridge security vulnerabilities after the Kelp DAO rsETH bridge was exploited for approximately $292 million. During his evaluation of DeFi bridging systems for RLUSD use, Schwartz observed that bridge providers consistently deprioritized their most robust security mechanisms in favor of convenience, a pattern he believes may have contributed to the Kelp DAO incident.

The Security Features Sales Pitch

In his analysis shared on X, Schwartz described how bridge providers pitched advanced security features prominently, then immediately suggested those features were optional. “They generally in effect recommended not bothering to use the most important security mechanisms because they have convenience and operational complexity costs,” he wrote.

Schwartz noted that during RLUSD evaluation discussions, providers emphasized simplicity and ease of adding multiple chains “with the implicit assumption we wouldn’t bother using the best security features they had.” He summarized the contradiction: “Their sales pitch was that they have the best security features but they’re easy to use and scale, assuming you don’t use the security features.”

What Happened to Kelp DAO

On April 19, Kelp DAO identified suspicious cross-chain activity involving rsETH and paused contracts across mainnet and multiple Layer 2 networks. Approximately 116,500 rsETH was drained through LayerZero-related contract calls, worth around $292 million at current prices.

On-chain analysis from D2 Finance traced the root cause to a private key leak on the source chain, which created a trust issue with OApp nodes that the attacker exploited to manipulate the bridge.

LayerZero Security Configuration

LayerZero itself offers robust security mechanisms, including decentralized verification networks. Schwartz hypothesized that part of the problem may stem from Kelp DAO choosing not to use key LayerZero security features “out of convenience.”

Investigators are examining whether Kelp DAO configured its LayerZero implementation using a minimal security setup—specifically, a single point of failure with LayerZero Labs as the sole verifier—rather than utilizing the more complex but significantly more secure options available through the protocol.