KelpDAO sues LayerZero and CEO over $292M rsETH bridge exploit
KelpDAO sues LayerZero and CEO Bryan Pellegrino over rsETH exploit
KelpDAO has filed a lawsuit against the cross-chain protocol LayerZero and its co-founder and CEO, Bryan Pellegrino, over the exploit of its rsETH bridge earlier this year. KelpDAO says failures in LayerZero's security infrastructure contributed to the attack, which took roughly $292 million of rsETH, the token issued by KelpDAO.
KelpDAO said Friday that LayerZero failed to disclose risks in its technology and did not prevent attackers from compromising its infrastructure. It also alleges that LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit.
Pellegrino rejected the claim. He called it "meritless" and said he would defend the case in Vancouver.
Key facts in the lawsuit
- KelpDAO filed the lawsuit against LayerZero, a protocol that moves assets between blockchains.
- The case also names LayerZero co-founder and CEO Bryan Pellegrino.
- The April 18 attack led to the theft of 116,500 rsETH, worth about $292 million at the time.
- KelpDAO says LayerZero approved its deployment and configuration in writing before the attack.
- Pellegrino called the claim meritless. Cointelegraph said it contacted LayerZero for comment and had not received a response before publication.
What KelpDAO says about the loss
In a post on X, KelpDAO wrote that the security of its users' assets has always been its top priority. It added that it needs to "correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem." DeFi, or decentralized finance, refers to financial services that run on blockchains without a central operator.
KelpDAO says the loss stemmed from failures in LayerZero's security infrastructure, including a failure to disclose risks in its technology and a failure to stop attackers from compromising that infrastructure.
What LayerZero's incident report found
In its final incident report on the attack, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. A verifier is a system that checks whether a message sent from one blockchain should be accepted by another.
LayerZero argued the loss was possible because KelpDAO's bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. With no second, independent verifier required, the bridge released the rsETH once LayerZero's verifier approved the forged message.
LayerZero said it had recommended using multiple DVNs and that it later stopped acting as the sole required verifier for applications.
Where the two sides disagree
KelpDAO has disputed LayerZero's account of who was responsible. In May, it said its DVN configuration had previously been discussed with LayerZero and "confirmed as secure," and accused LayerZero of failing to warn it adequately about the risks. KelpDAO later announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol.
The dispute centers on whether the loss came from the compromise of LayerZero's infrastructure, KelpDAO's bridge configuration, or both.
What is still unclear
No court has ruled on the case, and the outcome is unknown. LayerZero had not responded to Cointelegraph's request for comment at the time of publication, so its position in the article comes from its earlier incident report and Pellegrino's public response.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
About 20% of Bitcoin mining power is offline, according to Luxor
Fed Chair Warsh Flags AI as Potential New Factor of Production at Jackson Hole
