Kelp DAO Sues LayerZero Over $292M rsETH Exploit Tied to North Korea-Linked Hackers

·1 views

Kelp DAO, operating under parent company Evercrest Technologies, filed a civil lawsuit in British Columbia's Supreme Court against LayerZero Labs and co-founder Bryan Pellegrino over a $292 million exploit of its rsETH liquid restaking token in April 2026. Attackers, attributed to North Korea-linked group TraderTraitor, used social engineering to compromise LayerZero developer credentials and manipulate internal RPC nodes, allowing them to forge a cross-chain message that bypassed bridge verification. This enabled the minting of 116,500 unbacked rsETH tokens on Ethereum — about 18% of total supply — making it the largest single DeFi exploit of 2026. Kelp DAO alleges LayerZero was negligent and concealed flaws in its technology, with a key vulnerability being the bridge's single-verifier configuration that left no independent check against fraudulent attestations. LayerZero's Pellegrino has publicly denied the claims, calling the lawsuit meritless and stating he will contest it in Vancouver.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

XML Namespace Prefix Change by Customs Broker Halted 270 Shipments for Hours

A weekend platform upgrade by a customs broker changed the XML namespace prefix in their export declaration messages from 'cus' to 'ns2', which are technically equivalent but broke a six-year-old reader that matched elements by literal prefix string. On a Monday in October, 270 shipments sat uncleared at the warehouse while the system silently treated unreadable statuses as 'pending', logging no errors and acknowledging all messages normally. The issue went undetected until a warehouse lead called the broker repeatedly and obtained a raw message file, after which engineers patched the reader and replayed archived messages within the same afternoon. The fix replaced prefix-dependent XPath and regex logic with a namespace-aware parser that matches elements by URI and local name, and unreadable statuses now trigger alerts via a rejected queue instead of defaulting to pending. The team also updated contract tests to include messages with varied prefixes and requested advance notice from partners before any future platform changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Warehouse Fixes £400k Stock Error Problem by Treating Short Picks as Live Audits

A UK warehouse operation was losing nearly £400,000 annually in credits and lost orders due to persistent stock discrepancies between its inventory system and physical shelf contents. The system maintained a running balance calculated from scans rather than actual counts, meaning unscanned movements — such as damaged stock disposal or misplaced pallets — were never corrected until the annual stocktake. At the largest depot, one in seven locations held a quantity that differed from the system's recorded figure, with some empty locations generating daily short picks for over a month while replenishment never refilled them. The team redesigned their process so that a short pick now triggers an immediate location hold and a physical count within the hour, with continuous cycle counting prioritising high-risk and fast-moving locations. As a result, short picks have roughly halved and the annual stocktake has been reduced from three days to one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Three Converging Technologies Made AI Voice Agents Sound Human

AI phone agents have become significantly more human-sounding over the past two years, not due to a single breakthrough but because three core components — speech-to-text, language models, and text-to-speech — all matured simultaneously. Each stage must operate in a streaming fashion, overlapping rather than running sequentially, to keep response latency within the 800-millisecond window that human conversation demands. Turn-taking is managed through techniques like semantic endpointing, which judges whether a speaker has finished based on meaning rather than silence alone, and barge-in support that lets callers interrupt the agent naturally. Model selection also involves trade-offs, with many production systems using a smaller, faster model for routine exchanges and routing complex requests to a larger one. Despite major improvements in prosody and naturalness, current systems still struggle with proper nouns, regional place names, and non-English pronunciation, making locale-specific testing essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG Architecture Explained: Five Boxes, Six Arrows, and Hidden Costs

A Retrieval-Augmented Generation (RAG) system can be broken down into five core components: an index, a retriever, a reranker, a context builder, and a loop controller. Each connection between these components carries a data payload that incurs costs both when data is moved and when it is processed. The index sets a hard ceiling on system performance, since any fact lost during chunking or indexing cannot be recovered downstream by reranking or prompt engineering. The context builder is the only component that can actively reduce costs within a single request, while the loop controller poses the greatest billing risk because each additional iteration re-runs all upstream components. Engineers are advised to map every data transfer across their stack and price the largest one — the input into the model prompt — to estimate baseline monthly retrieval costs before any optimization.

0 comments Read more at DEV Community