KelpDAO 与 LayerZero：价值 2.92 亿美元的 rsETH 漏洞指责游戏在法庭上升温

KelpDAO 就价值 2.92 亿美元的 rsETH 漏洞起诉 LayerZero，引发了一场关于谁应对桥接安全故障负责的重大 DeFi 法律斗争。

Alright, New York, listen up! The digital wild west just got a whole lot wilder, with a legal showdown that's got the crypto world buzzing. KelpDAO, through its legal arm Evercrest Technologies, has officially slapped LayerZero and its co-founder, Bryan Pellegrino, with a civil claim in British Columbia. We're talking about the infamous April 18 rsETH bridge exploit that saw a cool $292 million vanish into the ether. This isn't just a squabble; it's a full-blown blame game over who's on the hook when cross-chain infrastructure goes sideways, and it's shaping up to be one of the biggest DeFi security disputes to hit the courts this year.

好吧，纽约，听着！数字狂野西部变得更加狂野，一场法律对决让加密世界热闹非凡。 KelpDAO 通过其法律部门 Evercrest Technologies 在不列颠哥伦比亚省正式向 LayerZero 及其联合创始人 Bryan Pellegrino 提出民事索赔。我们谈论的是 4 月 18 日臭名昭著的 rsETH 桥接漏洞，导致 2.92 亿美元的资金消失在以太坊中。这不仅仅是一场争吵；这是一场全面的指责游戏，当跨链基础设施出现问题时，谁该承担责任，这将成为今年法庭上最大的 DeFi 安全纠纷之一。

The Core of the Crypto Conflict: 1-of-1 DVN Under Fire

加密货币冲突的核心：1-of-1 DVN 受到攻击

At the heart of this legal brouhaha is the so-called '1-of-1 DVN configuration' – basically, a single point of failure in the Decentralized Verifier Network that KelpDAO's rsETH bridge was running on. KelpDAO is crying foul, alleging that LayerZero didn't just fail to spill the beans on known weaknesses in its tech, but also that its own infrastructure was breached, allowing North Korea-linked attackers (hello, TraderTraitor!) to forge a transaction. They claim LayerZero even gave written approval for this very setup before the whole thing went kaboom. Imagine, you get a thumbs-up, then get blamed when the roof caves in. Tough break!

这场法律风波的核心是所谓的“1-of-1 DVN 配置”——基本上，是运行 KelpDAO 的 rsETH 桥的去中心化验证网络中的单点故障。 KelpDAO 大声疾呼，声称 LayerZero 不仅没有透露其技术中已知的弱点，而且其自身的基础设施也遭到破坏，从而允许与朝鲜有关的攻击者（你好，TraderTraitor！）伪造交易。他们声称，在整个事情爆发之前，LayerZero 甚至对这一设置给予了书面批准。想象一下，你得到了竖起大拇指，然后当屋顶塌陷时受到指责。艰难的突破！

LayerZero, naturally, isn't taking this lying down. Pellegrino has publicly slammed the claims as 'meritless' and is gearing up for a fight in Vancouver. Their stance? KelpDAO willingly opted for the single-verifier setup, supposedly against better advice. But here's where it gets juicy: KelpDAO insists this configuration was widely used and approved by LayerZero in writing. This isn't just about a technical glitch; it's about what was said, what was promised, and what was written down. It's a classic 'he said, she said' with nine figures on the line.

LayerZero 自然不会坐视不管。佩莱格​​里诺公开抨击这些说法“毫无根据”，并准备在温哥华进行战斗。他们的立场？ KelpDAO 自愿选择了单一验证者设置，据说是反对更好的建议。但有趣的地方在于：KelpDAO 坚称此配置已被广泛使用并得到 LayerZero 的书面批准。这不仅仅是技术故障；它是关于所说的话、所承诺的以及所写下的。这是一个经典的“他说，她说”，有九个数字。

The Attack's Anatomy: Social Engineering and Compromised Nodes

攻击剖析：社会工程和受损节点

The incident report reads like a spy thriller. It all kicked off on March 6 when an attacker, using some slick social engineering, managed to snatch session credentials from a LayerZero developer. Fast forward to April 18, and those same bad actors infiltrated LayerZero's cloud environment, tweaking internal RPC nodes used by the LayerZero Labs DVN. Then, a denial-of-service attack conveniently knocked out external RPC providers, leaving the verifier dependent on those compromised internal nodes that, surprise, fed it false blockchain state. The result? A forged cross-chain message got a valid attestation, and 116,500 rsETH walked right out the digital door.

事件报告读起来就像一部间谍惊悚片。这一切都始于 3 月 6 日，当时攻击者使用一些巧妙的社交工程，成功从 LayerZero 开发人员那里窃取了会话凭据。快进到 4 月 18 日，同样的坏人渗透到了 LayerZero 的云环境中，调整了 LayerZero Labs DVN 使用的内部 RPC 节点。然后，拒绝服务攻击很容易地击垮了外部 RPC 提供者，使验证者依赖于那些受损的内部节点，令人惊讶的是，这些节点向其提供了错误的区块链状态。结果呢？伪造的跨链消息得到了有效证明，116,500 rsETH 直接走出了数字大门。

It's like a heist movie where the security guard gets tricked, then the cameras are jammed, and the bad guys stroll in with a fake key. LayerZero's own investigation, corroborated by security giants like Mandiant and CrowdStrike, points the finger at TraderTraitor, a North Korea-linked threat actor. This wasn't a flaw in the rsETH token contract itself; it was an attack on the off-chain verification infrastructure, a critical chink in the armor of cross-chain bridging.

这就像一部抢劫电影，保安被欺骗，然后摄像机被卡住，坏人拿着假钥匙溜进来。 LayerZero 自己的调查得到了 Mandiant 和 CrowdStrike 等安全巨头的证实，将矛头指向了与朝鲜有关的威胁组织 TraderTraitor。这并不是 rsETH 代币合约本身的缺陷；而是 rsETH 代币合约本身的缺陷。这是对链下验证基础设施的攻击，这是跨链桥接装甲上的一个关键漏洞。

What's Next for DeFi Accountability?

DeFi 问责制的下一步是什么？

This lawsuit isn't just about KelpDAO and LayerZero; it's a bellwether for the entire DeFi space. Who's truly accountable when shared infrastructure fails? Past cases have seen everything from parent companies covering losses (like after the Ronin hack) to claims being dismissed because protocols were treated as decentralized code. LayerZero might try the latter, but if KelpDAO can whip out clear written approval of that 1-of-1 setup, it could be a game-changer.

这场诉讼不仅仅涉及 KelpDAO 和 LayerZero；它是整个 DeFi 领域的风向标。当共享基础设施出现故障时，谁真正负责？在过去的案例中，从母公司承担损失（如 Ronin 黑客事件之后）到因协议被视为去中心化代码而被驳回的索赔，一切都发生过。 LayerZero 可能会尝试后者，但如果 KelpDAO 能够对这种 1-of-1 设置提供明确的书面批准，那么它可能会改变游戏规则。

In the meantime, KelpDAO has already moved its rsETH operations to Chainlink CCIP, which, crucially, demands multiple independent validators. It's a smart move to batten down the hatches after such a storm. As for the legal tussle, expect a long, drawn-out battle. These court fights rarely go the distance; settlements often happen once discovery starts airing out all the dirty laundry. But whatever the outcome, this KelpDAO LayerZero lawsuit is set to write a new chapter in how DeFi projects negotiate, and enforce, security agreements with the very infrastructure they rely on. Stay tuned, folks, this is gonna be a wild ride!

与此同时，KelpDAO 已经将其 rsETH 操作转移到 Chainlink CCIP，最重要的是，这需要多个独立的验证器。在这样的暴风雨过后，采取措施做好准备是明智之举。至于法律纠纷，预计将是一场旷日持久的战斗。这些法庭斗争很少会持续很长时间。一旦发现开始揭露所有肮脏的事情，和解通常就会发生。但无论结果如何，这场 KelpDAO LayerZero 诉讼都将为 DeFi 项目如何与其所依赖的基础设施协商和执行安全协议写下新的篇章。请继续关注，伙计们，这将是一次疯狂的旅程！