The lesson stays the same: Bridges are not self-custody
Self-custody means nothing if centralized bridge infrastructure can still become the point of failure. Portal's atomic swaps are the only safe and secure path that is truly trust minimized đź”’
The root cause of the $290M rsETH bridge exploit, based on all available info, was a compromise of the official LayerZero Labs DVN node
LayerZero has long marketed itself as decentralized and free from centralized intermediaries, but in practice this is decentralization theater
When LayerZero refers to its centralized nodes as “Decentralized Verifier Networks”, that’s just marketing psyops
A significant portion of LayerZero activity depends on just a small handful of DVN nodes, in many cases just one or two, run by centralized companies including the LayerZero Labs team
In the rsETH incident, the chains themselves were functioning correctly, the failure was that the LayerZero Labs DVN node was compromised into emitting a forged message that downstream contracts treated as legitimate
The responsibility for securing bridge infrastructure sits with the provider, not with downstream protocols or users who trusted the marketing
But the deeper issue is architectural
LayerZero did not spend the time or resources required to build a genuinely decentralized network, they cut corners and shipped a centralized system wrapped in decentralized marketing
Real decentralization costs money and requires many independent node operators, multiple independent RPC infra providers, and genuine redundancy across the validation layer
When LayerZero cuts corners to save on costs, the burden gets shifted onto users and the broader industry in the form of catastrophic failures like this one
The AWS outage last year taking down LayerZero bridges should have been a clue just how centralized the LayerZero ecosystem was
Unfortunately, bridge risk does not stay contained, losses spread into major DeFi protocols and connected ecosystems
Chainlink CCIP was built specifically to eliminate this entire category of risk, with every bridge lane secured by numerous independent, security-reviewed node operators connected to multiple reputable RPC providers
That’s why CCIP has never been exploited and has never lost user funds across nearly three years of in-production operation on 70 blockchains
Wishing a speedy recovery to every team and user impacted by this incident, hoping funds can be recovered and the ecosystem comes out stronger on the other side