Kelp DAO's rsETH cross-chain bridge suffered a nearly $300 million attack due to a private key leak on the source chain, according to analysis by D2 Finance. The incident was not caused by a protocol-level vulnerability in LayerZero, but rather a trust issue with OApp nodes. The mainnet's rsETH OFT Adapter trusted messages from a node marked as a legitimate Kelp DAO deployment by LayerZero Scan, leading to the release of 116,500 rsETH in a single lzReceive call. This indicates the attack stemmed from the project's own source chain private key theft, not a setPeer injection.