LayerZero (ZRO)

Users are probably wondering why projects are still switching their crosschain infra from LayerZero to Chainlink.

The reason is a philosophical difference in their security model:

→ @LayerZero_Core: developers pick their own validators and thresholds
→ @chainlink CCIP: 16 independent nodes enforced at the protocol level

LayerZero's model is elegant. Each app picks its own validators, so a hack on one app can't bleed into another, but only if each app configures it correctly.

The problem is that LayerZero permitted a 1/1 setup, with one validator and a single point of failure.

At least now, the 1/1 configurations are gone, defaults are moving to 5/5, and Console was shipped with built-in anomaly detection.

But compared to LZ, CCIP is designed to avoid this misconfiguration risk. You can't get it wrong because the protocol doesn't give you the option.

Institutions will often choose less flexibility in exchange for zero misconfiguration risk.

That's why all these protocols are making the switch.

We’re sharing our completed post-mortem on the April 18th incident, prepared with @Mandiant and @CrowdStrike. We are publishing both an executive summary and the full report at the link below.

Over the past four weeks, we’ve worked with hundreds of partners to help them understand their current security posture, and harden it where appropriate. We’ll continue this work, alongside taking additional proactive steps for the benefit of not only our partners, but also the ecosystem as a whole.

We want to extend our thanks to our partners for their support and patience this past month. There’s a reason that over $12 billion has moved across the network in the past four weeks, and why the world’s most valuable asset issuers have stood by our side: they believe in us, in what the LayerZero protocol has to offer, and in the value of modular, isolated, application-controlled security.

The work continues. And we look forward to continue showing up for the applications that trust us with their business, as well as the

New post mortem confirms what we already knew: @LayerZero_Labs' centralized infrastructure was infiltrated by North Korean hackers, which resulted in the $292 million rsETH bridge exploit

Turns out this required only a single engineer to be socially engineered, whose laptop was fully compromised for over 6 weeks without detection before exploit was executed, an insane single point of failure and lack of adequate monitoring

This only builds on LZ Labs' extensive history of poor opsec, including trading memecoins like "McPepes" on production multisig keys, which weren't rotated for years and Bryan lied about and said was just "PEPE OFT testing" (3 keys on a 2-of-5 LZ Labs multisig were at risk of phishing attacks for years)

And nevermind the fact I called out the EXACT centralization risk that resulted in the rsETH exploit 2 years ago, directly to Bryan, who lied and said no project was using LZ Labs DVN in 1-1 config (in reality, multiple projects were)

Given it's now abundantly clear to anyone paying atte