Safe

Solv Protocol

LayerZero

Gnosis

LayerZero, a cross-chain messaging platform, is facing new accusations of operations security (OPSEC) failures. According to reports, its production multisig signing keys traded McPepes memecoin on Uniswap.&nbsp;Per the allegations, which were made public on May 8, 2026, faults were directed to key management techniques used by blockchain infrastructure companies.<h3 class="wp-block-heading" id="what-happened-with-layerzero-s-2-of-5-gnosis-safe-multisig">What happened with LayerZero’s 2-of-5 Gnosis Safe multisig?</h3>The accusations center on reckless use of LayerZero’s 2-of-5 Gnosis Safe multisig, a method by which they secure their users’ tokens and control key parts of their OFT infrastructure.&nbsp;From screenshots of an internal discussion that went viral on X, three of the five signers of the Gnosis Safe multisig were actively involved in activities unrelated to the multisig process.<blockquote class="twitter-tweet">🚨JUST IN: <a href="https://twitter.com/LayerZero_Core?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@LayerZero_Core</a> is facing opsec allegations after production multisig keys used to secure user funds were reportedly also used to trade the McPepes memecoin. LayerZero’s Bryan said the transactions were made by people who were part of the LZ multisig but have since… <a href="https://t.co/k5YR7jyCg6" rel="noopener noreferrer nofollow">pic.twitter.com/k5YR7jyCg6</a>— SolanaFloor (@SolanaFloor) <a href="https://twitter.com/SolanaFloor/status/2052695468862517417?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 8, 2026</a></blockquote>Signer addresses include:<ul class="wp-block-list"><li>0x1f5E377a3ADBe6f3289ADb6b21eae6427dfbb553, which is associated with the trading of the memecoin called PEPES (McPepes) and the Hop platform.</li><li>0xBb6633c267951E938F9B6421E4F54aa5b2c19326, which held approximately $12 million and engaged in Stargate staking.</li><li>0x6fC8342C448F9a8d541C17579EF7A14237b8d5aD, involved in liquidity provisioning on Curve, PancakeSwap, and SpookySwap.</li></ul>A <a href="https://x.com/SolanaFloor/status/2052695468862517417" rel="noopener noreferrer nofollow">notable</a> transaction on March 1, 2023, involved exchanging 0.198548073 ETH for approximately 1.73 million tokens of the ERC-20 token McPepes/PEPES via Uniswap V3.This has been cited as evidence that the production keys, whose purpose was to safeguard billions of dollars, were linked to websites outside the network, thereby leaving them vulnerable to phishing attacks.&nbsp;The multisig lacked a timelock, and the keys remained stagnant for several years. The same parties are responsible for the multisig-controlled DVN settings and libraries for <a href="https://www.cryptopolitan.com/solv-drops-layerzero-for-chainlink-ccip/" rel="noopener noreferrer nofollow">LayerZero-compatible protocols</a>.On-chain transactions support the assertion that the production signers performed Uniswap swaps for the McPepes prior to the PEPE token deployment schedule.<h3 class="wp-block-heading" id="reported-vulnerabilities-tied-to-the-multisig-setup">&nbsp;Reported vulnerabilities tied to the multisig setup</h3>The LayerZero multisig was created to serve as the ultimate layer of protection for bridged tokens. Nevertheless, the described actions broke the fundamental OPSEC rule of key isolation. By using the same keys to trade on decentralized exchanges, the signers risked vulnerability to attacks from malicious contracts and phishing schemes.&nbsp;It is worth mentioning that only two stolen keys were enough to empty the whole multisig.The timing of the disclosure is associated with increased scrutiny of LayerZero’s security approach. As reported by <a href="https://www.cryptopolitan.com/solv-drops-layerzero-for-chainlink-ccip/" rel="noopener noreferrer nofollow">Cryptopolitan,</a> only hours before that, Solv Protocol revealed its intention to migrate more than $700 million worth of tokenized BTC (SolvBTC and xSolvBTC) to Chainlink’s CCIP from LayerZero.&nbsp;The company cited updates to security reviews and bridge issues, such as the recent <a href="https://www.cryptopolitan.com/layerzero-founder-fires-at-kelpdao-hack/" rel="noopener noreferrer nofollow">Kelp DAO hack</a> that used LayerZero bridges. Although <a href="https://insights.solv.finance/solv-protocol-migrates-from-layerzero-to-chainlink-ccip/" rel="noopener noreferrer nofollow">Solv</a> did not mention this incident in its announcement, it still illustrates a certain degree of skepticism toward LayerZero.<h3 class="wp-block-heading" id="layerzero-s-ceo-bryan-pellegrino-speaks-on-the-matter">LayerZero’s CEO Bryan Pellegrino speaks on the matter</h3>In response to the accusations, LayerZero’s CEO, Bryan Pellegrino, said the transactions originated from former members of the multisig wallet who had been booted out. He denied there was any such thing as “memecoin trading,” saying that it was just OFT testing, not speculations.&nbsp;Furthermore, he pointed out that the wallets were no longer involved in signatory functions.<figure class="wp-block-image size-full"><figure id="attachment_266366" class="wp-caption alignnone"><img class="wp-image-266366" src="https://www.cryptopolitan.com/wp-content/uploads/2026/05/image-25.png" alt="LayerZero multisig keys caught trading McPepes memecoin" width="761" height="427"><figcaption id="caption-attachment-266366" class="wp-caption-text"> LayerZero CEO Bryan Pellegrino denies accusations. Source: <a href="https://x.com/Crypto_Jargon/status/2052710230170198467" rel="noopener noreferrer nofollow">X</a></figcaption></figure></figure>As shown in the screenshots, skeptics raised issues regarding the description of the incident, citing that the transaction was between McPepes (not PEPE) and raising doubts about how ETH to memecoin trading via Uniswap could be classified as OFT tests.The signers in question have reportedly been removed from the multi-signature. No counter-rebuttal or full audit of all previous actions carried out by the signers had been made public by LayerZero.<h3 class="wp-block-heading" id="crypto-twitter-goes-after-layerzero">Crypto Twitter goes after LayerZero</h3>Zach Rynes has gone against LayerZero, calling the security measures a “horrific opsec.” Rynes pointed out the dangers posed by such behavior to <a href="https://www.cryptopolitan.com/kelp-migrates-rseth-bridge-to-chainlink-ccip/" rel="noopener noreferrer nofollow">users running LayerZero</a> in its default settings. He has cited potential supply-chain exploits.Additionally, he asserts that production keys must never be used for anything other than vital tasks.<blockquote class="twitter-tweet">I genuinely wish I were joking, it’s horrifying what passes for “opsec” in this industry— Zach Rynes | CLG (@ChainLinkGod) <a href="https://twitter.com/ChainLinkGod/status/2052573434631389641?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 8, 2026</a></blockquote>X community reactions range from shock at what they perceived as “clowns and criminals” working within the infrastructure domain to a call for more openness and transparency.Any potential vulnerabilities within the multisig of LayerZero, which acts as an intermediary for chain-to-chain communication, could be very concerning.Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Problems pile up for LayerZero amid fresh memecoin trading accusations

Table of Contents

Cryptopolitan_News

Other articles published on May 8, 2026

How Has Pi Network Performed in 2026?

Toncoin Surges as Telegram Takes Over as Largest TON Validator

What Is the BNB Chain Osaka/Mendel Upgrade?

Tom Lee's Bitmine has Staked 88% of its ETH Holdings

When Will CLARITY Finally Pass?

Solidus AI Tech Rebrands to AITECH Cloud Network (ACN) and Announces Migration to Ethereum

Join our free newsletter for daily crypto updates!