Connect with us
DAPA Banner

Crypto World

The $292 million Kelp DAO exploit shows why crypto bridges are still one of the industry’s weakest links

Published

on

The $292 million Kelp DAO exploit shows why crypto bridges are still one of the industry's weakest links

The $292 million exploit tied to KelpDAO is the latest in a long line of crypto bridge hacks, underscoring how the systems designed to connect blockchains have become some of the easiest ways to break them.

The incident involved KelpDAO’s use of LayerZero’s cross-chain messaging system, a type of infrastructure widely used to move data and assets between blockchains.

Bridges are meant to let users move assets from one blockchain to another, like from Ethereum to a different network. But instead of acting as seamless connectors, they have repeatedly turned into weak points, draining billions of dollars over the past few years.

So why does this keep happening?

Advertisement

Crypto ecosystem leaders say the answer is not just bad code or careless mistakes. The problem is more fundamental; it is in how bridges are built in the first place.

The core problem: trusting the middleman

To understand the issue, it helps to look at what a bridge actually does.

If you move tokens from one blockchain to another, the second chain needs proof that your tokens existed and were locked on the first one. In an ideal world, it would verify that itself. In reality, that is too expensive and complex.

“Most bridges don’t fully verify what happened on another chain,” said Ben Fisch, CEO of Espresso Systems. “Instead, they rely on a smaller system to report it. That [second] system becomes the thing you trust.”

Advertisement

So instead of independently checking the truth, bridges outsource it, often to small validator groups or external networks like LayerZero or Axelar. That shortcut creates risk. In the Kelp DAO-related exploit, attackers targeted the data feeding into the bridge.

“Attackers compromised nodes and fed the system a false version of reality,” Fisch said. “The bridge worked as designed. It just believed the wrong information.”

Bridge hacks often look different on the surface. Some involve stolen keys, others faulty smart contracts. But experts say those are symptoms of a deeper issue. The real problem lies in how the systems are designed.

“Anything that can go wrong will go wrong, and bridge hacks are a perfect example,” said Sergej Kunz, co-founder of 1inch. “You see code vulnerabilities, centralization issues, social engineering, even economic attacks. Usually it’s a mix.”

Advertisement

How bridges work

For users, bridges look simple. You click a button and move assets from one blockchain to another. Behind the scenes, the process is more complicated.

First, your tokens are locked on the original blockchain. Then a separate system confirms that the tokens are locked. This system usually consists of a small group of operators or validators. Those operators then send a message to the second blockchain saying the tokens were locked so new ones can be issued. If that message is accepted, the second chain creates a new version of your tokens. These are wrapped tokens, like rsETH or WBTC.

The problem is that this process depends on trusting whoever sends that message. If attackers compromise that system, they can send a false message and create tokens that were never backed on the original chain.

“The worst case is when the system isn’t really checking anything,” Fisch said. “It’s just trusting someone else’s version of events.”

Advertisement

When one failure spreads

Given how often bridges fail, why has the industry not fixed them?

Part of the answer comes down to incentives. “Security is often not the top priority,” Kunz said. “Teams focus on launching quickly, growing users and increasing total value locked.”

Building secure systems takes time and money. Many DeFi projects operate with limited resources, making it difficult to invest heavily in audits, monitoring and infrastructure.

At the same time, projects are racing to support more blockchains. Each new integration adds complexity. “Every new connection adds more assumptions,” Fisch said.

Advertisement

Bridge hacks rarely stay contained. Bridged assets are used across lending protocols, liquidity pools and yield strategies. If those assets are compromised, the damage spreads.

“Other platforms may treat a hacked asset as legitimate,” Kunz said. “That’s how contagion happens.” Users are rarely told how a bridge actually works or what could go wrong.

There are ways to make bridges safer. Fisch says one key step is removing single points of failure by relying on independent data sources rather than shared infrastructure.

In practice, these “data sources” are computers that watch blockchains and report what happened. They might be run by the bridge itself, by outside networks like LayerZero, or by infrastructure providers. But many rely on the same underlying services, meaning a single compromised source can feed bad data across multiple systems.

Advertisement

“If everyone is relying on the same source, you haven’t reduced risk,” he said. “You’ve just copied it.”

Other approaches include hardware protections and better monitoring to catch misconfigurations early. Some developers are also working on designs that verify data directly using cryptography instead of intermediaries.

Kunz believes a more fundamental shift is needed. “As long as we rely on validator-based bridges, these problems will continue,” he said.

Read more: North Korea’s crypto heist playbook is expanding and DeFi keeps getting hit

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Adam Back Addresses Satoshi Nakamoto Rumors at LONGITUDE Paris

Published

on

Adam Back Addresses Satoshi Nakamoto Rumors at LONGITUDE Paris

Blockstream CEO Adam Back, the British cryptographer and inventor of Hashcash, said it’s “flattering” that people think he’s Satoshi Nakamoto and was probably the result of his being a little too “talkative” on the cypherpunk mailing list that started it all. 

Back was speaking in a fireside chat with Cointelegraph at the recent LONGITUDE event in Paris, co-hosted by crypto exchange OKX, with discussions centered on crypto regulation, market structure and the growth of stablecoins.

Adam Back denies renewed suggestions that he invented Bitcoin

“It is flattering in some sense that they think you could have done it,” Back told Cointelegraph, reflecting on the widely publicized New York Times article on April 8 that suggested he is Satoshi, a claim he has denied. 

Back said there is a logical reason people think he’s Bitcoin’s creator. “The problem for me is I was very talkative on the mailing list,” he said, referring to the 1992 Cryptography Mailing List, where Satoshi later introduced the Bitcoin white paper in October 2008.

Advertisement

“So anytime anyone was talking about electronic cash, I was right there, I was the reply guy with something to say about it,” he said. 

Blockstream CEO Adam Back speaking at LONGITUDE. Source: Cointelegraph

Back said the mystery behind Satoshi is an “interesting question” that he and others in the industry have pondered but never answered.

Prior to the fireside with Back, the event also featured three panels covering the role of traditional financial institutions in Web3, the need for clearer regulation and the pace of stablecoin adoption, alongside a separate fireside chat with OKX Europe CEO Erald Ghoos.

MiCA is “extremely beneficial,” but brings risks to innovation

Crypto industry executives said recent moves to regulate the industry have been positive for improved clarity, but regulatory fragmentation and overregulation could hurt innovation. 

In an onstage interview, Ghoos shed light on the Markets in Crypto-Assets (MiCA) regulation, a framework with which OKX Europe was deemed fully compliant in January 2025.

Advertisement

“I think MiCA is extremely beneficial for the industry,” Ghoos said, explaining that it has helped to build trust in crypto. 

OKX Europe CEO Erald Ghoos speaking to Cointelegraph journalist Ciaran Lyons at LONGITUDE. Source: Cointelegraph

“Now it is a fully regulated asset class, which is very important,” Ghoos said, adding that industry participants will be “vetted and held up to the highest standards.”

However, he warned that the “regulatory burden” could slow innovation across Europe.

“Right now, because there is such a big and heavy regulatory overhead for startups, I do fear even more that the innovation and the great entrepreneurship that we have in Europe will start to shift to other jurisdictions around the world,” he said.

CertiK CEO Ronghui Gu said the lack of a unified global framework is a pain point for the industry.

Advertisement

“For developers, for crypto companies in different regions, they are still under different compliance frameworks,” Gu said. 

Commenting on the proposed US CLARITY Act, which has been delayed largely because of unresolved issues around stablecoin yields impact on the banking system, Gu said that while the bill aims to bring structure, “many terms are not that clear to be honest, and a little bit vague.” 

“I think different firms have different interpretations and so on,” he added.

Ronghui Gu speaking at LONGITUDE. Source: Cointelegraph

“But I would say it definitely gives a much more friendly environment to crypto companies, to developers,” he added.

Cardano Foundation CEO Frederik Gregaard said he is “very confident” the CLARITY Act will pass soon, adding: “You feel the vibration from the policymakers saying we are going to adopt this,” he said.

Advertisement

“They are super stoked about it,” Gregaard added.

Frederik Gregaard speaking at LONGITUDE. Source: Cointelegraph

“When this passes, from the non-TradFi adoption, you are going to see 100X,” Gregaard said, arguing that “classical industries” have been waiting for clarity before embracing the technology.

US Senator Thom Tillis of North Carolina said on Monday that he does not expect the Senate Banking Committee to mark up the legislation, also known as the CLARITY Act, in April and has recommended that Senate Banking Chair Tim Scott schedule it for next month.

Payments industry does a good job of “almost faking” real-time payments

Mastercard’s senior vice president for blockchain and digital assets, Christian Rau, said that stablecoins are “very well suited for payment purposes” during a panel with Stella Development Foundation chief business officer Raja Chakravorti and Ethereum Foundation enterprise lead Matthew Dawson.

“They don’t come with the volatility of other digital assets, given that they enjoy regulatory clarity in a lot of the world,” Rau said.

Advertisement

Rau said the traditional payments industry does a “good job of almost faking real-time payments.”

“When I tap my card, it says transaction approved or payment made…it’s authorization, clearing, and settlement,” he said.

“A lot of the things that work arguably very well today, they still come with time delays, costs, and so forth,” he added.

Related: How Mastercard plans to settle card payments with stablecoins

Advertisement

Meanwhile, Stella Foundation’s Chakravorti pointed to the roughly $317 billion in stablecoin circulation, which is up about 50% from last year, adding that he is starting to see some short-term cooling.

“Although to be clear, over the last two quarters, that’s started to slow down a little bit,” calling it a positive sign as it suggests parts of the underlying infrastructure are starting to mature.

“I think this next transition is local stablecoins, because people are now very focused on creating that opportunity in their economy as super important,” he said.

Chakravorti pointed to the “last mile” as one of the biggest hurdles for adoption, referring to the challenge of turning digital assets into something “workable” inside local financial systems.

Advertisement

“I think it is the absolute key, ultimately, that is where all the friction lies within this system,” he said.

Magazine: Adam Back says current demand is ‘almost’ enough to send Bitcoin to $1M