KelpDAO Sues LayerZero Over $292 Million rsETH Bridge Exploit

KelpDAO has filed a lawsuit against cross-chain protocol LayerZero following the roughly $292 million exploit of its rsETH bridge earlier this year, alleging that failures in LayerZero’s security infrastructure contributed to the attack.

KelpDAO said Friday that LayerZero failed to disclose risks in its technology or prevent attackers from compromising its infrastructure. It also alleged that LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit.

The lawsuit also names LayerZero co-founder and CEO Bryan Pellegrino.

“Our number one priority has always been and will remain the security of our users’ assets,” Kelp wrote. “But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem.”

Pellegrino called the claim “meritless” and said he would defend the case in Vancouver.

The lawsuit escalates a months-long dispute over whether the loss was caused by the compromise of LayerZero’s infrastructure, KelpDAO’s bridge configuration, or both.

Cointelegraph contacted LayerZero for further comment, but did not receive a response before publication.

Kelp and LayerZero have disputed responsibility since April

The April 18 attack resulted in the theft of 116,500 rsETH, worth about $292 million at the time, from Kelp’s LayerZero-powered bridge.

In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. It argued that the loss was possible because Kelp’s bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path.

With no second independent verifier required, the bridge released the rsETH after receiving LayerZero’s verifier approved the forged message. LayerZero said it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.

Kelp has disputed LayerZero’s account of responsibility. In May, it said its DVN configuration had previously been discussed with LayerZero and “confirmed as secure,” while accusing LayerZero of failing to adequately warn it about the risks. Kelp subsequently announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol.