Lost in the (sea)weeds

Wow. This has been one of the biggest months ever for crypto hacks, so we’ve got a lot to work with.Let’s start here. On April 18th, a bridge used to transfer KelpDAOs liquidity token between chains got a message.The message said a user wanted to transfer tokens from unichain to ethereum, and that the tokens were already sent on the unichain side. So, the bridge did what it always does, and released tokens back to them on ethereum.The only problem was, the message wasn’t real.Bridges have often been the soft underbelly of crypto protocols. So how did it happen? We’ll dive into Kelp, the LayerZero protocol, and how attackers got onto two servers that turned out to be securing the whole thing.By the way, this episode starts with an explanation of KelpDAO, a “liquid restaking provider”. Don’t worry if you get lost in the seaweeds on that, we did as well. Just keep going. Now on to it.