KelpDAO Sues LayerZero and CEO Over $292M rsETH Bridge Exploit

Lawsuit Details and Allegations by KelpDAO

On Friday, KelpDAO announced a lawsuit against LayerZero, accusing the protocol of failing to disclose technological risks and preventing attackers from compromising its infrastructure. The lawsuit also notes that LayerZero had previously reviewed and endorsed the deployment and configuration of KelpDAO’s bridge in writing before the exploit.

The complaint also names LayerZero’s co-founder and CEO Bryan Pellegrino. KelpDAO emphasized that securing users’ assets has always been its top priority, but asserted the need to correct the record and hold LayerZero and Pellegrino accountable for the harm inflicted on them and the broader DeFi ecosystem.

LayerZero's Response and Pellegrino's Stance

Pellegrino dismissed the lawsuit as meritless and expressed his intention to defend the case in court in Vancouver.

Before publication, Cointelegraph did not receive any public comment from LayerZero representatives.

Incident Background and Responsibility Dispute

The April 18 attack resulted in the theft of 116,500 rsETH, valued at about $292 million at the time, from KelpDAO’s LayerZero-powered bridge.

LayerZero’s incident report stated that the attackers compromised its internal nodes and tricked the verifier into approving a forged cross-chain message. It argued the loss happened because KelpDAO’s bridge relied solely on a single LayerZero decentralized verifier network (DVN) as the verification method.

Due to the absence of an independent secondary verifier, the bridge processed the rsETH release following LayerZero’s verifier approval of the forged message. LayerZero recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.

KelpDAO's Rebuttal and Next Steps

KelpDAO disputed LayerZero’s account of blame, stating that their DVN configuration had been discussed and confirmed as secure by LayerZero beforehand.

In May, KelpDAO announced plans to migrate its rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol to enhance security.

The parties remain in a dispute over accountability for the loss, debating whether LayerZero’s infrastructure compromise, KelpDAO’s bridge setup, or both were at fault.