KelpDAO Sues LayerZero Over $292M rsETH Bridge Exploit

KelpDAO has filed a lawsuit against cross-chain protocol LayerZero and its co-founder and CEO Bryan Pellegrino, alleging that security failures in LayerZero's infrastructure enabled the roughly $292 million exploit of its rsETH bridge earlier this year. According to KelpDAO, LayerZero reviewed and endorsed the bridge's deployment and configuration in writing before the April 18 attack, which resulted in the theft of 116,500 rsETH. The protocol claims LayerZero failed to disclose risks in its technology or prevent attackers from compromising its infrastructure.

The dispute centers on responsibility for the breach. In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message, arguing the loss was possible because Kelp's bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. LayerZero stated it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications. KelpDAO has contested this account, saying in May that its DVN configuration had been previously discussed with LayerZero and confirmed as secure.

Pellegrino called the lawsuit's claims meritless and said he would defend the case in Vancouver. "Our number one priority has always been and will remain the security of our users' assets," KelpDAO said in a statement. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem." The legal action escalates a months-long dispute between the two parties, and KelpDAO has since announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol. Cointelegraph contacted LayerZero for comment but did not receive a response before publication.