KelpDAO sues LayerZero and CEO over $292m rsETH bridge exploit
KelpDAO has filed a lawsuit against LayerZero and chief executive Bryan Pellegrino, alleging security failures contributed to the roughly $292 million rsETH bridge exploit in April.
Key points
- KelpDAO filed the lawsuit on Friday against LayerZero and co-founder and CEO Bryan Pellegrino.
- The April 18 attack drained 116,500 rsETH, worth about $292 million at the time, from Kelp's LayerZero-powered bridge.
- LayerZero's final incident report said attackers compromised internal nodes and its verifier approved a forged cross-chain message.
- LayerZero argued the loss was possible because Kelp's bridge used a single decentralised verifier network as its only verification path.
- Pellegrino called the claim meritless and said he would defend the case in Vancouver.
KelpDAO has sued cross-chain protocol LayerZero and its co-founder and chief executive Bryan Pellegrino over the roughly $292 million exploit of its rsETH bridge earlier this year, according to CoinTelegraph. The lawsuit alleges that failures in LayerZero's security infrastructure contributed to the attack.
KelpDAO said on Friday that LayerZero failed to disclose risks in its technology and did not prevent attackers from compromising its infrastructure. It also alleged that LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit. The lawsuit names Pellegrino as well as the company.
In a statement, Kelp said its top priority had always been and would remain the security of its users' assets. It added that it needed to correct the record and hold LayerZero and Pellegrino accountable for the harm caused to Kelp and the wider DeFi ecosystem. Pellegrino dismissed the claim as meritless and said he would defend the case in Vancouver.
Lawsuit filed over bridge exploit
The filing escalates a dispute that has run for months over whether the loss stemmed from the compromise of LayerZero's infrastructure, KelpDAO's bridge configuration, or both. CoinTelegraph said it contacted LayerZero for further comment but received no response before publication.
The April 18 attack resulted in the theft of 116,500 rsETH, worth about $292 million at the time, from Kelp's LayerZero-powered bridge. In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message.
LayerZero argued the loss was possible because Kelp's bridge relied on a single LayerZero decentralised verifier network as its only verification path. With no second independent verifier required, the bridge released the rsETH after LayerZero's verifier approved the forged message. LayerZero said it had recommended using multiple DVNs and later stopped acting as the sole required verifier for applications.
Dispute over verifier setup
Kelp has disputed that account. In May it said its DVN configuration had previously been discussed with LayerZero and confirmed as secure, while accusing LayerZero of failing to warn it adequately about the risks. Kelp later announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol.