KelpDAO's $292M Lesson: Why a 1/1 DVN Is the Cross-Chain Equivalent of a 1-of-1 Multisig

On April 18, 2026, an attacker drained 116,500 rsETH (~$292M) from KelpDAO's LayerZero bridge. It wasn't a LayerZero protocol bug. It was a configuration choice — a single required DVN, zero optional verifiers — and every OFT/OApp founder needs to audit their config today.