KelpDAO's parent company sues LayerZero over $292 million rsETH exploit

Evercrest Technologies files a civil claim in British Columbia

Evercrest Technologies, the company behind KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia on Thursday against LayerZero Labs Ltd., LayerZero Labs Canada Inc. and co-founder Bryan Pellegrino.

The filing concerns an April 18 exploit of 116,500 rsETH, which was worth about $292 million at the time. It alleges negligent misrepresentation, negligence and defamation.

According to the claim, LayerZero reviewed and endorsed the 1-of-1 decentralized verifier network (DVN) configuration used by the exploited Unichain bridge. A bridge is a tool that moves assets between blockchains.

Key points from the claim

• Evercrest is seeking damages for negligent misrepresentation, negligence and defamation, as well as aggravated and punitive damages.
• The filing says LayerZero told Evercrest in written communications on Feb. 2, 2024 that there was “no problem” with using the default DVN configuration.
• On March 21, 2024, LayerZero directed Evercrest to use the same 1-of-1 configuration as another bridge, according to the claim.
• The claim says the attack began on April 18 at about 17:35 UTC, after an attacker used social engineering to install malware on a LayerZero developer's computer to gain access to LayerZero's security infrastructure.
• Evercrest says KelpDAO users have withdrawn more than $650 million in assets since the exploit.

What the court filing alleges

The claim states: “The exploit was not a failure of KelpDAO's systems. It was a failure of LayerZero's own security infrastructure.”

Evercrest alleges LayerZero never warned it that a 1-of-1 configuration using LayerZero's own DVN posed a security risk, and never advised it to use multiple DVNs. The filing says LayerZero had warned another developer, USDT0, about risks tied to default DVN configurations before the exploit.

The claim also says LayerZero described its DVN infrastructure as having redundancy across multiple locations, along with monitoring and alerts. According to the claim, LayerZero represented that if a DVN were compromised, the most it could do was “fail to verify a message correctly.”

LayerZero co-founder calls the claim meritless

Pellegrino disputed the allegations. “The claim continues to be meritless,” he said on X, adding that he would defend himself accordingly.

Evercrest also disputes LayerZero's public response. The filing takes issue with LayerZero's claim that the configuration “directly contradicts” its recommended multi-DVN model, and says Pellegrino publicly blamed the protocol for using a 1-of-1 setup.

What is confirmed

The civil claim was filed in the Supreme Court of British Columbia. LayerZero Labs Ltd., LayerZero Labs Canada Inc. and Bryan Pellegrino are named as defendants. Pellegrino has publicly rejected the claim as meritless.

What is still unclear

The claims in the filing are allegations. The source material does not show a court ruling on them, and no decision is reported. It is also not clear from the source material whether LayerZero has filed a formal response to the claim beyond Pellegrino's public comment.

Impact on KelpDAO users and rsETH

Evercrest said the exploit disrupted KelpDAO's stablecoin plans, and its sbUSD product was later sunset after the attack. The company has also begun migrating rsETH to an alternative cross-chain security standard. More than $650 million in assets have been withdrawn by KelpDAO users since the exploit, according to the claim.

Sources

• The Block