logo
    • Buy Crypto
    • Markets
    • Futures
    • Spot
    • Earn
    • Affiliates & AI
    • More
    1. WEEX
    2. Crypto News
    3. The $293 million bug wasn't in the code; so, what's the deal with the "DVN Configuration Bug," which led to the largest hack of 2026?

    The $293 million bug wasn't in the code; so, what's the deal with the "DVN Configuration Bug," which led to the largest hack of 2026?

    By: blockbeats|2026/04/19 05:01:34
    0
    Share
    copy
    Prefer us on GooglePrefer us on Google
    ZROZRO
    00.00%--
    AAVEAAVE
    00.00%--
    COMPCOMP
    00.00%--
     

    On April 18, 2026, the liquidity restaking protocol of Kelp DAO was exploited, with the attacker siphoning off 116,500 rsETH from a cross-chain bridge within hours, amounting to approximately $293 million at the time. The entire process was efficiently executed with a hint of anomaly, starting from a forged cross-chain message to laundering the stolen funds across Aave V3, Compound V3, and Euler lending protocols with real assets borrowed. The attacker swiftly exited with $236 million worth of WETH on the same day. Aave, SparkLend, and Fluid promptly froze the rsETH market.

    This marks the largest DeFi exploit event of 2026.

    However, one aspect distinguishes this attack from most hacking incidents. The smart contract code of Kelp DAO had no vulnerabilities. Security researcher @0xQuit, involved in the investigation, stated on X, "From what I currently understand, this is a combination of two issues: a 1-of-1 DVN configuration and the compromise of the DVN node itself." In their official statement, LayerZero did not blame the contract code, categorizing the issue as an "rsETH vulnerability" rather than a "LayerZero vulnerability."

    The 93 million bug wasn't in the code; so, what's the deal with the

    $293 million was not in any line of code. It was concealed within a misconfigured parameter during deployment.

    The common logic behind DeFi security audits is: find the contract, read the code, find vulnerabilities. This logic operates quite smoothly when dealing with code logic vulnerabilities. Tools like Slither and Mythril are mature in detecting known patterns such as reentrancy attacks and integer overflows. The widely promoted LLM for assisting in code audits also has some capability in identifying business logic vulnerabilities (e.g., flash loan arbitrage paths).

    However, in this matrix, two rows are marked in red.

    Configuration-level vulnerabilities fall into a structural blind spot in tool-based audits. The issue with Kelp DAO was not in a .sol file but in a parameter—DVN threshold—written during protocol deployment. This parameter determines how many validating nodes a cross-chain message must pass through to be considered valid. It's not in the code, not within Slither's scanning scope, nor in Mythril's symbolic execution path. According to Dreamlab Technologies' comparative study, Slither and Mythril detected 5/10 and 6/10 vulnerabilities in the tested contract, respectively. However, these results are based on the premise that the vulnerabilities exist in the code. According to IEEE research, even at the code level, existing tools can only detect 8%-20% of exploitable vulnerabilities.

    From the perspective of the current audit paradigm, there is no tool that can "detect whether the DVN threshold is reasonable." To detect this type of configuration risk, what is needed is not a code analyzer, but a specialized configuration checklist: "Is the number of DVNs for the cross-chain protocol ≥ N?" "Is there a minimum threshold requirement?" Such questions are currently not covered by standardized tools and there is no widely recognized industry standard.

    Also within the red zone is key and node security. In @0xQuit's description, it is mentioned that a DVN node was "compromised," which falls under Operational Security (OpSec) and is beyond the detection boundary of any static analysis tool. Whether it is a top-tier auditing firm or an AI scanning tool, none have the ability to predict whether a node operator's private key will be leaked.

    This attack simultaneously triggered two red zones in the matrix.

    DVN is the cross-chain message verification mechanism of LayerZero V2, fully named Decentralized Verifier Network. Its design philosophy is to entrust security decision-making to the application layer: each protocol connecting to LayerZero can choose the number of DVN nodes required to confirm before allowing a cross-chain message to pass.

    This "flexibility" has created a spectrum.

    Kelp DAO chose the far-left end of the spectrum with a 1-of-1, requiring only one DVN node to confirm. This means a fault tolerance of zero, as an attacker only needs to compromise that single node to forge any cross-chain message. In contrast, Apechain, also connected to LayerZero, configured more than two required DVNs and was not affected by this event. The wording in the LayerZero official statement was, "All other applications remain secure," implying that security depends on the selected configuration.

    The standard industry recommendation is at least 2-of-3, where an attacker would need to compromise two independent DVN nodes simultaneously to forge a message, increasing fault tolerance to 33%. A high-security configuration like 5-of-9 can raise fault tolerance to 55%.

    The issue is that external observers and users cannot see this configuration. Also known as being "supported by LayerZero," the backend could range from 0% fault tolerance to 55% fault tolerance, both referred to as DVN in the documentation.

    Seasoned crypto investor Dovey Wan, who experienced the Anyswap incident, directly stated on platform X: "LayerZero's DVN turned out to be a 1/1 validator... All cross-chain bridges should immediately undergo a comprehensive security review."

    In August 2022, a vulnerability was discovered in the Nomad cross-chain bridge. Someone replicated the initial attack transaction, made minor modifications, and found success, leading to hundreds of addresses replicating the exploit and draining $190 million in a matter of hours.

    Postmortem analysis by Nomad attributed the vulnerability to "initializing the trusted root as 0x00 during a routine upgrade." This was a configuration error that occurred during the deployment phase. The Merkle proof validation logic and the code itself were sound; the issue stemmed from an incorrect initial value.

    Combining this incident with previous ones involving Nomad, configuration/initialization vulnerabilities have now resulted in approximately $482 million in losses. In the history of cross-chain bridge exploits, this category's scale now rivals that of key exposure incidents (e.g., Ronin $624 million, Harmony $100 million, Multichain $126 million, totaling around $850 million).

    However, the product design of the code auditing industry has never been focused on this category of vulnerabilities.

    Most discussions in the industry still revolve around code logic bugs. Incidents like Wormhole's $326 million exploit due to signature verification bypass and Qubit Finance's $80 million loss due to a fake deposit event are well-analyzed with detailed vulnerability reports, CVE references, and reproducible PoCs, making them suitable for audit tool training and optimization. Configuration layer issues are not explicitly coded, making it challenging to address within the production cycle.

    One notable detail is the distinct triggering mechanisms of the two configuration-related events. Nomad's error stemmed from inadvertently setting an incorrect initial value during a routine upgrade, constituting a mistake. On the other hand, Kelp DAO's 1-of-1 incident was an active configuration choice—LayerZero protocol did not prohibit this option, and Kelp DAO did not violate any protocol rules. A "compliant" configuration choice and a "mistaken" initial value both led to the same outcome in the end.

    The execution logic of this attack was straightforward. A forged cross-chain message informed the Ethereum mainnet that "someone had already locked up an equivalent asset on another chain," triggering the minting of rsETH on the mainnet. The minted rsETH itself had no real backing, but its on-chain record was "valid" and could be accepted by lending protocols as collateral.

    The attacker then dispersed 116,500 rsETH to Aave V3 (Ethereum and Arbitrum), Compound V3, and Euler, borrowing over a total of $236 million in real assets. According to multiple sources, the standalone default estimate for Aave V3 is around $177 million. Aave's security module Umbrella, used to absorb default losses, has a WETH reserve of around $50 million with a coverage ratio of less than 30%, with the remaining amount to be borne by aWETH stakers.

    This ultimately falls on those who simply wanted to earn some WETH interest.

    As of the time of writing, LayerZero is still conducting a joint investigation with the security emergency response organization SEAL Org and plans to release a post-incident analysis report in collaboration with Kelp DAO once all information is obtained. Kelp DAO has stated that they are working on "active remediation."

    The $293 million exploit is not in the code. The phrase "audit passed" did not cover the location of that parameter.

    -- Price

    --

    This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.

    You may also like

    DePIN project Vangrid raises $9 million in token round to build spatial data network for physical AI

    DePIN project Vangrid raises $9 million in token round to build spatial data network for physical AI

    The Enigmatic Corner of Buenos Aires Ideal for a Different Winter Getaway

    The Enigmatic Corner of Buenos Aires Ideal for a Different Winter Getaway

    A corner with thermal waters, impressive ruins, and unique landscapes awaits those seeking a different plan without having to travel far.
    MoonPay Launches Payment and Stablecoin Management Platform for Enterprises

    MoonPay Launches Payment and Stablecoin Management Platform for Enterprises

    MoonPay has announced the launch of MoonPay Enterprise, a platform developed to integrate payment services, issuance, clearing, and fund management into a single environment using stablecoins. This solution is designed to serve banks, fintechs, payment companies, and merchants operating in various m...
    Aerolíneas Argentinas Closed 2025 with Surplus and Will Pay Taxes for the First Time in Its 77-Year History

    Aerolíneas Argentinas Closed 2025 with Surplus and Will Pay Taxes for the First Time in Its 77-Year History

    The state-owned company approved its balance for the last fiscal year with a net profit of $238 billion, positive net equity, and an operating surplus of $120.7 million. It did not receive state contributions.
    BNY and BlackRock funnel billions through one infrastructure provider, exposing the fragile illusion of crypto diversification

    BNY and BlackRock funnel billions through one infrastructure provider, exposing the fragile illusion of crypto diversification

    Institutional crypto staking can concentrate validator power across Ethereum and Solana while customers earn yield without controlling keys.
    Vaca Muerta in 2040: Why This Year Could Be Key for Argentina

    Vaca Muerta in 2040: Why This Year Could Be Key for Argentina

    A report projected that up to 80% of the world's major oil companies could experience significant production declines by 2040. This scenario strengthens the strategic value of long-term assets like Vaca Muerta, although Argentina will need to sustain investments, infrastructure, and technology to tr...
    Flooding in the AMBA after the storm: affected areas and precautions to take

    Flooding in the AMBA after the storm: affected areas and precautions to take

    Precipitation will intensify during the afternoon, with gusts of up to 90 km/h, electrical activity, and occasional hail.
    How institutional dark pools quietly ate 15% of crypto volume and killed the retail whale-watching edge

    How institutional dark pools quietly ate 15% of crypto volume and killed the retail whale-watching edge

    Crypto dark pools may improve liquidity and execution while making large institutional trades harder for retail investors to see.
    Crypto Stocks Shaken by Bitcoin: Kaiko Research Highlights Coinbase and Circle's Key Factors as 'Scale, Liquidity, and Diversification'

    Crypto Stocks Shaken by Bitcoin: Kaiko Research Highlights Coinbase and Circle's Key Factors as 'Scale, Liquidity, and Diversification'

    Cryptocurrency-related stocks have been moving separately from the upward trend of the U.S. stock market in 2026, further highlighting their 'Bitcoin (BTC) beta' characteristics. Kaiko Research's Thomas Probst...
    AI Trading Bots: 9 Services and Platforms for Stock Trading

    AI Trading Bots: 9 Services and Platforms for Stock Trading

    AI trading bots take on the rapid analysis of the market: they analyze charts, news, on-chain data, and trading metrics, helping to find potential entry points and automating repetitive actions. Artificial intelligence does not eliminate risks but reduces the share of impulsive decisions and saves t...
    Massive Bitcoin Sale: Jim Cramer Says He Wants to Sell His BTC

    Massive Bitcoin Sale: Jim Cramer Says He Wants to Sell His BTC

    Jim Cramer sells his bitcoin after the quantum alert from IBM's CEO. A look back at a real technical signal and a host who has been wrong ten times.
    Exchanges for Trading in Russia: 2026 Ranking and Platform Selection

    Exchanges for Trading in Russia: 2026 Ranking and Platform Selection

    When choosing exchanges for trading in Russia, it is important to focus not on the brand's loudness but on practical aspects: how quickly the terminal operates, whether there is sufficient liquidity, if there are clear ways to deposit from Russia, and whether real costs are hidden in commissions, sp...
    CFTC chief backs innovation in $1.2 quadrillion derivatives market

    CFTC chief backs innovation in $1.2 quadrillion derivatives market

    Crypto for Advisors: Europe's crypto rules, U.S. Preview

    Crypto for Advisors: Europe's crypto rules, U.S. Preview

    Closure of Illia Highway and part of Cantilo Avenue due to Pampa Underpass works

    Closure of Illia Highway and part of Cantilo Avenue due to Pampa Underpass works

    The restriction will begin on Friday at 10 PM and extend until 6 AM on Saturday, with detours via Figueroa Alcorta and Del Libertador avenues.
    Zoomex Monthly Transparency Report: July 2026

    Zoomex Monthly Transparency Report: July 2026

    Crypto Drainers: How Cryptocurrency is Stolen and Whether Funds Can Be Recovered?

    Crypto Drainers: How Cryptocurrency is Stolen and Whether Funds Can Be Recovered?

    Crypto Sector in Congress May Strengthen Despite Rare Primary Defeat

    Crypto Sector in Congress May Strengthen Despite Rare Primary Defeat

    The crypto sector in Congress is likely to continue expanding its representation following a series of primaries in the United States, although the largest political committee in the industry faced a notable setback in Detroit: the incumbent congressman supported by the committee, Shri Thanedar, los...
    Stablecoin payments are going mainstream. What happens when the recipient needs local currency?

    Stablecoin payments are going mainstream. What happens when the recipient needs local currency?

    Stablecoins simplify cross-border payments, but local-currency liquidity, FX conversion and reliable settlement remain essential for mainstream adoption.
    Visa Unveils $2.4 Billion Investment Against AI Fraud

    Visa Unveils $2.4 Billion Investment Against AI Fraud

    Visa acquires Israeli specialist BioCatch for $2.4 billion, betting on behavioral biometrics to detect AI fraud upstream.
    Binance's Lawsuit for $470 Million: Can RedotPay's IPO Dream Survive?

    Binance's Lawsuit for $470 Million: Can RedotPay's IPO Dream Survive?

    When Bottlenecks Begin to Migrate - Repricing of Interconnect, HBM, and the Entire Storage Empire

    When Bottlenecks Begin to Migrate - Repricing of Interconnect, HBM, and the Entire Storage Empire

    August 6, Veterinarian Day in Argentina: origin of this date

    August 6, Veterinarian Day in Argentina: origin of this date

    The commemoration recalls the start of classes in Veterinary and Agronomy at the Santa Catalina Agricultural Institute in Llavallol in 1883.
    "Sell America" Trade Makes a Comeback! Global Funds Reprice Washington's Policy Risks

    "Sell America" Trade Makes a Comeback! Global Funds Reprice Washington's Policy Risks

    Report: If Inflation Data is Strong in the Coming Weeks, Waller is Prepared to Raise Rates in September

    Report: If Inflation Data is Strong in the Coming Weeks, Waller is Prepared to Raise Rates in September

    Sources indicate that although Waller has suggested the possibility of reducing the Fed's $6.7 trillion balance sheet to tighten monetary policy, rates remain the primary tool and will be utilized in subsequent meetings if necessary.
    Javier Milei authorized the entry of Brazilian troops amid diplomatic tension with Lula da Silva

    Javier Milei authorized the entry of Brazilian troops amid diplomatic tension with Lula da Silva

    The Government authorized naval maneuvers with Brazil, Chile, and Peru between August and October. The decision was made amid escalating diplomatic tensions between Javier Milei and Luiz Inácio Lula da Silva.
    24-Hour Crypto Retention: What the Central Bank's Proposal Changes

    24-Hour Crypto Retention: What the Central Bank's Proposal Changes

    European Investment Bank Allocates €400 Million for Social Housing in Ukraine: Where the First Apartments Will Be

    European Investment Bank Allocates €400 Million for Social Housing in Ukraine: Where the First Apartments Will Be

    Discussing L1 Value Capture Through Two Proposals from Solana

    Discussing L1 Value Capture Through Two Proposals from Solana

    Bitcoin Whales Accumulate; Analyst Breaks the Myth That This Is a Bullish Signal

    Bitcoin Whales Accumulate; Analyst Breaks the Myth That This Is a Bullish Signal

    DePIN project Vangrid raises $9 million in token round to build spatial data network for physical AI

    The Enigmatic Corner of Buenos Aires Ideal for a Different Winter Getaway

    A corner with thermal waters, impressive ruins, and unique landscapes awaits those seeking a different plan without having to travel far.

    MoonPay Launches Payment and Stablecoin Management Platform for Enterprises

    MoonPay has announced the launch of MoonPay Enterprise, a platform developed to integrate payment services, issuance, clearing, and fund management into a single environment using stablecoins. This solution is designed to serve banks, fintechs, payment companies, and merchants operating in various m...

    Aerolíneas Argentinas Closed 2025 with Surplus and Will Pay Taxes for the First Time in Its 77-Year History

    The state-owned company approved its balance for the last fiscal year with a net profit of $238 billion, positive net equity, and an operating surplus of $120.7 million. It did not receive state contributions.

    BNY and BlackRock funnel billions through one infrastructure provider, exposing the fragile illusion of crypto diversification

    Institutional crypto staking can concentrate validator power across Ethereum and Solana while customers earn yield without controlling keys.

    Vaca Muerta in 2040: Why This Year Could Be Key for Argentina

    A report projected that up to 80% of the world's major oil companies could experience significant production declines by 2040. This scenario strengthens the strategic value of long-term assets like Vaca Muerta, although Argentina will need to sustain investments, infrastructure, and technology to tr...
    ...
    Exclusive new user rewards
    Sign up to get 10 USDT
    Exclusive new user rewardsSign up

    Contents

    ZRO

    Latest articles

    2026/05/21

    FTX/Alameda Wallet Transfers Over $8 Million in ZRO Tokens to Wintermute

    Key Takeaways An FTX/Alameda-associated wallet moved 4.126 million ZRO tokens to market maker Wintermute, with an approximate value…

    ZROZRO
    00.00%--
    2026/05/06

    Why is a16z Crypto raising another $2.2 billion to heavily invest in Web3?

    This round of funding bets on the transition of cryptocurrency from the infrastructure development phase to the phase of real user adoption. Whether focusing on cryptocurrency or crossing over to AI, this real money will only flow to those places that can turn technology into products.
    ZROZRO
    00.00%--
    SOLSOL
    00.00%--
    UNIUNI
    00.00%--
    2026/05/04

    The billion-dollar lesson: The focus of DeFi security is shifting from code to operational governance

    Warning of nearly $1 billion loss in DeFi: Security pain points have shifted from code vulnerabilities to permissions and operations. Introducing TradFi bank-level risk control and AI defenses is the way to balance openness and security.
    ZROZRO
    00.00%--
    AAVEAAVE
    00.00%--
    2026/04/30

    Morning Report | Visa includes Polygon in its global stablecoin settlement program; MoonPay invests $100 million to acquire security company Sodot; Digital wallet platform Belo completes $14 million Series A financing

    Overview of Important Market Events on April 29
    ZROZRO
    00.00%--
    EIGENEIGEN
    00.00%--
    ETHETH
    00.00%--
    SOLSOL
    00.00%--
    ARBARB
    00.00%--
    2026/04/26

    How to balance risk and return in DeFi yields?

    Have these yields ever been reasonable? Have we ever received the compensation we deserve for the risks taken in DeFi, and where should the future spreads be set?
    ZROZRO
    00.00%--
    AAVEAAVE
    00.00%--
    SOLSOL
    00.00%--
    USDCUSDC
    00.00%--
    More

    Latest coin listings on WEEX

    logoCommunity
    iconiconiconiconiconiconicon
    Customer Support:@weikecs
    Business Cooperation:@weikecs
    Quant Trading & MM:bd@weex.com
    VIP Program:support@weex.com
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Customer Support Bot
    • VIP Services
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Customer Support Bot
    • VIP Services
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE

    Where new wealth is made

    Download app

    Sign Up
    h5 logo
    Download