The Contested Autopsy: Crypto’s Blame Wars After the Hack

The $292 Million Question Two Teams Answered Differently

On April 18, 2026, about $292 million in value backing the rsETH liquid restaking token left the system after attackers tied to North Korea’s Lazarus Group compromised the cross-chain messaging layer that KelpDAO relied on to move funds between blockchains. That much is settled. Almost nothing else is.

LayerZero, whose infrastructure sat beneath the exploit, said Kelp had chosen a dangerously thin security setting against its guidance. Kelp said the setting was LayerZero’s own documented default, reviewed and approved in writing across years of integration work. The two sides argued in public for five months. Then the disagreement did what crypto disagreements increasingly do when nobody can agree on the autopsy: it went to court. On September 24, 2026, Evercrest Technologies, the company behind KelpDAO, filed a civil claim in the British Columbia Supreme Court against LayerZero Labs and its co-founder and chief executive Bryan Pellegrino, seeking to recover the loss and alleging the firm publicly blamed Kelp for LayerZero’s own failure while holding a written endorsement of the configuration in question.

A crypto post-mortem is supposed to be the opposite of a lawsuit. The genre was borrowed from software reliability engineering, and its founding rule is that it should be blameless: reconstruct the timeline to the minute, locate the root cause in the system rather than in a person, publish the findings, ship the fix, and move on. In 2026 that ideal came apart. The year’s largest incidents did not each produce one agreed autopsy. They produced rival autopsies, competing timelines, and running fights over the one word that matters most in any of them, which is fault. This is a look at those blame wars: why crypto keeps having them, what exactly the combatants fight about, and how a reader can tell an honest contested post-mortem from a public-relations knife fight.

What a Blameless Post-Mortem Was Supposed to Be

The template every crypto incident report imitates comes from Google’s site reliability engineering practice, whose blameless post-mortem doctrine holds that when a system fails, the useful question is not who typed the bad command but why the system let a single command cause an outage. Name the contributing factors, not the culprit. Punishing an individual teaches everyone else to hide mistakes; fixing the system teaches the organization to survive them. The output is a document with a strict shape: a summary, a minute-by-minute timeline, a root-cause analysis, an impact assessment, and a list of action items with owners.

Crypto grafted a second ancestor onto that structure, one that fits an industry that is half software and half entertainment. The confessional, audience-facing voice of the modern exploit write-up owes as much to the games industry’s long tradition of the public postmortem, the What Went Right and What Went Wrong essay that developers have published since the late 1990s, as it does to any engineering manual. The result is a native public genre. Sites like Rekt’s leaderboard turned the autopsy into collective memory, a rolling hall of shame that doubles as an oral history of every way a smart contract can die.

When the genre works, it is genuinely impressive. After the March 2023 Euler Finance flash-loan attack drained roughly $197 million, the attacker and the protocol negotiated on-chain, the attacker wrote that they had no intention of keeping what was not theirs, and nearly all of the funds came back. After the February 2025 Bybit theft of about $1.5 billion, chief executive Ben Zhou published third-party forensic reports from Sygnia within days and ran the response in the open. Those are the models, and they share one quiet feature: everyone involved agreed, more or less, on what had happened.

Why Crypto Cannot Stay Blameless

Reliability engineering invented the blameless post-mortem inside a single company, where the server that failed, the engineer who pushed the change, and the manager reading the report all draw a paycheck from the same employer. There is no adversary. There is no money leaving the building. There is, above all, a boss who can enforce the no-blame rule. Crypto has none of those conditions, and every one of the missing pieces turns the autopsy into a fight.

Start with the adversary. A software outage has no villain; an exploit has a person on the other side who took the money and who often narrates their own version of events in an on-chain message. Add the money itself: a post-mortem in crypto is not a learning exercise, it is the opening argument in a dispute over who eats a nine-figure loss. Add the structure. Modern DeFi is a stack of protocols leaning on one another, so a single exploit routinely implicates three or four teams at once, each with its own token, its own investors, and its own reason to point across the table. There is no shared employer to impose calm, and there is no referee. When a prediction market cannot agree on who settles a disputed outcome, it at least has an oracle and a governance vote to fall back on; a hacked protocol and its dependencies have neither.

So the incentives invert. The blameless ideal asks each party to absorb responsibility for the good of the system. The economics of a hack ask each party to shed responsibility for the good of its own balance sheet and its own reputation. The autopsy becomes the venue where that fight plays out, in real time, in front of an audience that is also deciding whether to keep its money in any of the protocols involved. The wonder is not that crypto post-mortems turn into blame wars. It is that any of them stay blameless.

Case File: KelpDAO Versus LayerZero

The Kelp dispute is the cleanest specimen of the genre because both sides are still standing, both are articulate, and both have receipts. The mechanism at issue is a LayerZero feature called the Decentralized Verifier Network, or DVN, the set of independent parties that attest a cross-chain message is real before the destination chain acts on it. Kelp’s rsETH pathway ran what is called a 1-of-1 DVN, meaning a single verifier could wave a message through. When Lazarus got inside that verifier, there was no second signer to catch the lie.

LayerZero’s first public account put the choice on Kelp, describing the single-verifier setting as a decision made against guidance. Kelp answered that the setting was not some reckless override but LayerZero’s own onboarding default, the one its documentation, quickstart guides, and developer examples steered integrators toward, and that LayerZero’s defaults were what actually caused the disaster. Then came the data. A Dune analysis Kelp cited found that roughly 47 percent of the active LayerZero application contracts on chain were running the exact same 1-of-1 configuration, with about 45 percent on 2-of-2 and only around 5 percent using three verifiers or more; nearly half the ecosystem sat on the same floor Kelp was blamed for. Kelp went further, saying LayerZero had reviewed its configuration across eight documented integration conversations over more than two years and never objected to the setup it later blamed.

On May 9, LayerZero blinked. In a public statement the firm admitted, in its own words, that it had done ‘a terrible job on comms over the past three weeks,’ conceded it had ‘made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions,’ and said it ‘didn’t police what our DVN was securing, which created a risk we simply didn’t see’ (The Block reported the apology in full). It also shipped changes: retiring 1-of-1 service, migrating defaults to require at least five verifiers where possible with a floor of three, building a second verifier client in Rust, and raising an internal multisig threshold from three-of-five to seven-of-ten. Pellegrino, for his part, has not fully conceded, maintaining that Kelp started on safer multi-verifier defaults before manually switching its routes to the single-verifier setting, and that LayerZero’s documentation warns integrators not to treat one DVN as production ready. That unresolved gap between the company apology and the chief executive’s rebuttal is exactly why, four months later, the argument became a filing in a Vancouver courtroom.

Case File: The Liquid Network’s Four Rival Stories

If Kelp is a two-sided dispute, Blockstream’s Liquid Network produced a four-way one. On September 6, 2026, an attacker exploited a flaw in Elements, the software that runs the Bitcoin sidechain, minting unbacked L-BTC and cashing it out through SideSwap for roughly 4,000 BTC, worth about $320 million at the time. The federation’s 11-of-15 multisig signed the peg-out because the transaction looked valid to every honest signer; a quorum of trusted parties is no defense when the bug is in the rules they are all enforcing.

Then the narratives split. The attacker left an on-chain note claiming to be a white hat, asked Blockstream to patch the bug first, and sought a 10 percent bounty. Two independent forensic accounts, one from Halborn and one from Chainalysis, converged on the same unglamorous root cause: a cache-key collision in the range-proof verification code that failed to make each proof unique, so a forged proof could reuse a cached valid verdict. Both also flagged the detail that turned a bug into a scandal, which is that the fix already existed in the public codebase but had not yet been rolled into a tagged release the federation was running.

That patch gap lit the fuse on a disclosure fight. The Bitcoin Red Team, co-led by a developer known as Calle, said it had warned Blockstream about the weakness beforehand, and Calle needled the company that it apparently cost ‘600 BTC to ignore an email from the red team.’ Blockstream’s former chief security officer Samson Mow rejected that outright, saying no emails were ignored, and chief executive Adam Back attributed the flaw to an incorrect fix of an AI-found bug that he called non-critical. Blockstream, meanwhile, refused the entire white-hat framing, calling the episode theft rather than responsible disclosure and threatening to bring in law enforcement if the money did not come back. Ledger chief technology officer Charles Guillemet put the industry’s skepticism plainly, noting that white hats do not drain a bridge and then solicit an on-chain contact. In the end the attacker returned 3,400 BTC and kept about 598.5 BTC, roughly $47 million, as a self-awarded bounty; block production resumed on September 10, and Back urged holders not to panic sell over the counter, promising the L-BTC peg would be covered one for one. Four parties, one $320 million hole, and no two accounts that fully agree.

The Same Event, Two Autopsies

Line up the year’s contested cases and a pattern appears. The fights are not random; they cluster around a handful of recurring questions, and almost every disputed post-mortem is really an argument about one or more of them. The table below shows how the same event splits into rival stories depending on who is telling it.

Sort those disputes by what is actually being argued and they reduce to four questions. Each one maps to a different layer of an incident, and each is contested for its own structural reason.

Hack, or White Hat?

The first and rawest dispute is whether a theft even happened. Crypto is the only industry where the person who took the money routinely claims to have done the victim a favor, and where that claim sometimes holds up. The white-hat framing is not always cynical: the Euler attacker really did return the funds, and over the years a handful of drainers have handed everything back for a negotiated bounty or nothing at all. That precedent is exactly what makes the framing so contested, because it hands every attacker a script. Drain the protocol, leave a note asking the team to fix the bug, request 10 percent, and dare them to call it a crime.

Liquid is the case where that script met a team that refused to read along. Blockstream would not grant the white-hat label to someone who took $320 million without permission and then negotiated its return, and much of the industry agreed, precisely because a genuine white hat discloses privately and does not hold user funds hostage to a bounty. But the label matters beyond semantics. If the taking was theft, it is a crime and the funds are stolen property; if it was research, it edges toward the gray zone where bounties and safe-harbor pledges live. The Security Alliance has tried to draw that line in advance with a Safe Harbor framework that pre-authorizes good-faith rescue within set limits, but no framework can retroactively bless a $320 million drain that the taker only reframed as a rescue after the fact. The phrase white hat is doing legal work, which is why every party fights over it.

The framing survives because it occasionally proves true on a scale that dwarfs Liquid. When Poly Network was drained of more than $600 million in August 2021, the attacker returned nearly all of it, declined a $500,000 bounty, and was offered a role as the project’s chief security advisor, becoming the industry’s original Mr. White Hat (Poly Network made the offer publicly). Cases like that are why a team cannot simply dismiss the claim out of hand, and why the negotiation that follows a hack has hardened into a ritual with its own etiquette: the on-chain message, the bounty math, the deadline. The rhetoric is doing real work, because the difference between a felon and a consultant can come down to how the first message is worded.

Whose Code Was It, Anyway?

When the theft itself is not in dispute, the fight moves one layer down, to whose code failed. Modern protocols are assembled from other people’s software, and every dependency is a potential defendant. Curve Finance, drained for tens of millions in July 2023, could point out with justification that the flaw was a reentrancy-lock bug in specific versions of the Vyper compiler, not in Curve’s own logic; critics answered that shipping hundreds of millions of dollars on a young toolchain was itself the decision that failed. Sui’s Cetus lost about $223 million in May 2025 to an overflow check in a third-party math library, raising the same question in a different language.

The Kelp dispute is this argument in its purest cross-chain form. Was the failure in Kelp’s configuration or in LayerZero’s default that produced that configuration? The honest answer, the one both a courtroom and a neutral engineer would reach, is that responsibility is shared and the interesting question is how it should be split. That is precisely the answer a blame war is built to avoid, because shared responsibility means shared cost. It is also why the industry’s move toward clearer accountability at the signing layer matters: standards work like EIP-7702 and the push to make wallet delegation legible is, at bottom, an effort to make it obvious after the fact who authorized what, so the next post-mortem has fewer places to hide.

The dependency question keeps widening as DeFi grows more layered. It is no longer only compilers and math libraries in the dock; it is the risk curators who tune a lending market’s parameters, the oracle that feeds it prices, and the vault managers who route other people’s deposits into strategies they did not write. Cetus is instructive here because the flaw sat in a third-party library whose Move-language pedigree, marketed on memory safety, had quietly lowered everyone’s scrutiny of exactly the kind of overflow check that failed. A post-mortem that has to apportion blame across a compiler, a library author, an integrator, and a curator is not going to end in a tidy paragraph, and the parties know it, which is why each tries to write the paragraph first.

Disclosed, or Ignored?

The third axis is about the days before the exploit rather than the moment of it. Almost every serious bug has a paper trail: a report, a commit, an audit finding, a red-team email. When money is lost, that trail becomes evidence, and the fight is over who saw what and when. The pattern the security world calls an n-day is the sharpest version. A fix ships publicly, attackers read the commit, and anyone who has not yet updated is exposed until they do; the patch that was meant to protect users becomes a map to the vulnerability.

Liquid is a textbook n-day. The fix for the range-proof bug was already in the public Elements codebase but had not reached a tagged release the federation was running, which is why the Bitcoin Red Team’s separate claim that it had also warned Blockstream directly turned into such a bitter exchange, with Calle saying his emails were ignored and Mow insisting none were. Both cannot be fully right, and there is no neutral log either can point to that settles it. This is where crypto could borrow more than a template from the wider security industry. Coordinated vulnerability disclosure has established norms, from CISA guidance to the ninety-day clocks that projects like Google’s Project Zero enforce, precisely so that after an incident nobody has to relitigate who emailed whom. Crypto has bounty platforms and the Security Alliance, but no shared, enforceable disclosure standard, so the disclosure timeline becomes one more thing the parties get to dispute.

The Newest Scapegoat Is the Machine

2026 added a defendant that cannot argue back. When Adam Back attributed the Liquid flaw to an incorrect fix of a bug that had been found by AI, he was doing something new in the genre: assigning a share of the blame to a tool. It is a tempting move, because it is partly true. Teams across the industry now use AI to find and patch bugs, and an AI that surfaces a non-critical issue whose fix introduces a critical one is a real failure mode. But it is also a convenient one, because a model makes an ideal scapegoat: it has no reputation to defend and no lawyer to send.

The same dynamic runs the other way in bug bounties, where AI has flooded programs with plausible-looking but worthless reports, so much so that maintainers now spend real time triaging machine-generated noise. The blame in these cases is genuinely distributed among the human who prompted the tool, the human who reviewed its output, and the human who chose to ship. A post-mortem that stops at the AI found it is not a root-cause analysis; it is a press release. The most useful reports of the year named the model’s role and then kept going, to the humans who decided what to do with what the machine said.

The uncomfortable part is that the machine defense will get more plausible, not less. As AI moves from finding bugs to writing and patching production code, the chain of custody on any given line will run through a model at least once, and a post-mortem that wants to assign blame will have to decide how much a tool that no human fully reviewed can be said to have failed. The answer that keeps the genre honest is the same one it has always needed: name every contributor, human and automated, and stop pretending that a diffuse cause is the same thing as no cause.

The Rare Autopsy That Takes the Blame

Against all of this, one recent case stands out for how differently it was handled. When Balancer was drained of more than $100 million across nine networks in November 2025, the trail led to a rounding-direction error that had lived in the code for years. What made the episode unusual was the auditor’s response. Trail of Bits, which had reviewed related Balancer code in 2021, published a retrospective acknowledging that it had flagged the underlying issue back then, as finding TOB-BALANCER-004, and had rated it at undetermined severity because it could not prove exploitability at the time. The firm wrote that it now knew the pools hacked that Monday were exploited through the same vulnerability it had reported, and reflected on how a one-wei precision loss that looks trivial to a fuzzer can become substantial enough to be profitable in a low-liquidity pool with the wrong parameters (the full retrospective is public).

Owning a miss like that is rare because it is expensive; it invites exactly the criticism that a blame war is designed to deflect. It also sits inside a harder truth the year kept teaching, summarized bluntly by developer Suhail Kakar after Balancer, who noted that a vault audited three separate times by different firms still got hacked, and that being audited by a big name has come to mean almost nothing. No regulator anywhere accredits smart-contract auditors; there is no PCAOB for Solidity. In that vacuum, a firm that publicly owns its miss is doing something the market cannot force it to do, which is why the honest post-mortem remains the exception rather than the rule.

When the Autopsy Goes to Court

When the community cannot settle a contested autopsy, the fight escalates to the one venue that can compel an answer. The starkest example is Avraham Eisenberg, who drained more than $110 million from Mango Markets in October 2022 and called it a highly profitable trading strategy rather than a hack, arguing that he had only used the protocol as its own code allowed. A jury disagreed and convicted him in 2024; then a federal judge vacated the convictions in 2025 on the grounds that the venue was improper and that there was no rule Mango had actually written that he had broken, a genuine code-is-law outcome in a real courtroom. The Department of Justice appealed, and the case remains a live reminder that the definition of a hack can turn on jurisdiction and on whether anyone bothered to write the rules down.

The Eisenberg saga also shows why the courtroom rarely delivers the clean verdict the community wants. Criminal cases turn on questions a post-mortem never asks, such as where a trade was placed and whether a protocol wrote down any rules at all, so the same facts can produce a conviction, an acquittal, and an appeal in sequence. Other attackers who returned funds, from Euler to Poly Network, were never charged at all, which means the legal system’s answer to whether a given drain was a crime depends heavily on whether the money came back and whether the taker stayed anonymous. That is not a principle so much as a lottery, and it pushes disputes that could be crimes toward the civil track instead.

Kelp’s lawsuit is the civil version of the same escalation. Unable to extract a shared-fault settlement from LayerZero, Evercrest took the disagreement to the British Columbia Supreme Court, converting a public blame war into a discovery process where the eight integration conversations and the written endorsements Kelp says it holds will either exist or not. This is what accountability looks like when the informal system fails, and it is not unique to protocol disputes: it is the same instinct that lets regulators pursue exchanges over compliance failures that a post-mortem alone would never punish. A courtroom is a blunt instrument for a nine-figure engineering dispute, but when the autopsy cannot agree with itself, it is the only instrument left.

The Blame War Is the Accountability System

It is tempting to read all of this as dysfunction, and some of it is. But the blame wars also fill a vacuum that nobody else is filling. In the United States, the Securities and Exchange Commission oversees the exchanges and custodians that touch customer funds, and it can force disclosure and impose penalties when they fail; in March 2026 the SEC and CFTC even clarified that most crypto assets are not themselves securities, narrowing rather than widening the perimeter. That deregulatory turn, and the way the broader crypto rulebook keeps resetting to new deadlines, means the perimeter is not about to expand to reach the autonomous DeFi protocols where most of the year’s money was lost. When rsETH depegs or L-BTC is minted from nothing, there is no regulator to file a complaint with, no deposit insurance, and no agency that will reconstruct the timeline. The post-mortem, and increasingly the lawsuit, is the only accountability process that exists.

That vacuum is widening even as the losses grow, with Bitcoin trading around $84,000 in late September 2026 after a rate-hike-driven pullback. The reason the blame moved is that the attack surface moved. A July 2026 Rekt editorial that circulated widely made the point that the year’s biggest losses all passed their audits because the auditors were checking the code, and the code was fine; the real exposure had climbed the stack, to governance, to signers, and to the people building the protocols. When the failure is in the people and the process rather than in a line of Solidity, there is no neutral compiler to blame, so the humans blame each other. The tallies below show the shift.

Read together, the accountings say the same thing twice: the money is leaving through keys, signers, and operations, not through the code auditors know how to read. Blame is hardest to assign exactly where the losses are now largest.

How to Read a Contested Post-Mortem

For anyone trying to judge who is telling the truth after the next big hack, the shape of the report matters more than its tone. A few signals separate an honest contested autopsy from a public-relations exercise.

• Root cause versus scapegoat: an honest report names a specific technical failure and how it was reached, while a defensive one names another party and stops there.
• A neutral third account: when an independent firm such as Halborn or Chainalysis publishes findings, weigh those above any combatant’s self-description, and note where the partisans agree with the neutral account and where they quietly do not.
• Public evidence: on chain, the transactions are already public, so a party that will not share logs, commit histories, or a disclosure timeline is choosing opacity when transparency was free.
• Someone owning a miss: the rarest and most credible signal is a party, especially an auditor or the exploited team, that accepts a share of the fault instead of routing all of it elsewhere.
• Facts or framing: if the disagreement is about what happened, discovery can settle it; if it is only about what to call what happened (theft or research, default or override), the fight is about liability, not truth.

None of these guarantees an answer, and the whole point of a blame war is that a clean answer is usually unavailable. But a reader armed with them can at least tell the difference between a team reconstructing a failure and a team building a legal defense, which in 2026 is most of what reading a post-mortem has become.

Frequently Asked Questions

What is a blameless post-mortem in crypto?

A blameless post-mortem is an incident report, borrowed from software reliability engineering, that reconstructs how a system failed and locates the root cause in the system rather than punishing an individual. In crypto the format is widely imitated, but the blameless ideal often breaks down because real money, an actual attacker, and multiple independent teams give everyone a reason to assign fault instead of absorbing it.

Why did KelpDAO sue LayerZero?

KelpDAO’s operator, Evercrest Technologies, filed a civil claim in the British Columbia Supreme Court on September 24, 2026, seeking to recover about $292 million lost when attackers exploited a single-verifier setup on LayerZero’s cross-chain messaging in April 2026. Kelp alleges LayerZero publicly blamed it for the configuration while holding written approval of that setup, and that roughly 47 percent of LayerZero applications used the same setting.

Was the Liquid Network hack a white-hat operation?

The attacker who drained about $320 million from Blockstream’s Liquid Network in September 2026 claimed to be a white hat and returned 3,400 of the 4,000 BTC in exchange for keeping roughly $47 million. Blockstream rejected that label, calling the episode theft rather than responsible disclosure, and many in the industry agreed because a genuine white hat discloses privately instead of draining funds and negotiating a bounty afterward.

Who is responsible when a bridge or protocol gets hacked?

Responsibility is usually shared, which is what makes it disputed. A modern exploit can implicate the protocol that was drained, the infrastructure or dependency it relied on, the auditor that reviewed the code, and the humans who managed keys and configurations. Because no regulator accredits smart-contract auditors and DeFi protocols sit outside most oversight, the split is often argued out in public post-mortems and, increasingly, in court.

Can hack victims recover money through regulators like the SEC?

Usually not, if the loss happened on a decentralized protocol. In the United States the SEC oversees exchanges and custodians, not autonomous DeFi code, so there is typically no complaint to file and no deposit insurance when a protocol is exploited. Victims’ realistic paths to recovery are white-hat negotiation, bug-bounty returns, a backer choosing to make users whole, or private lawsuits.

Anneke de Vries is HOGE Wire’s security desk editor.