The $290M rsETH bridge exploit appears to be the result of a compromised 1-of-1 DVN configuration on
@LayerZero_Core
The sole validator was
@LayerZero_Labs itself, meaning one forged transaction from a single entity was sufficient to drain the entire bridge
In other words, a single point of failure (either private key or 3rd party RPC compromise)
I flagged this centralization risk years ago, unfortunate that it took an exploit for the issue to get broader attention