KelpDAO has filed a lawsuit against LayerZero and its co-founder Brian Pellegrino over the $292 million rsETH bridge exploit from earlier this year. The liquid restaking protocol alleges LayerZero failed to disclose weaknesses in its technology and failed to stop attackers from compromising its security infrastructure. Pellegrino has called the claim meritless and says he will defend it in a Vancouver court.
KelpDAO filed a lawsuit against LayerZero and its co-founder, blaming the universal bridge protocol for the largest exploit of this year, which drained $292 million. The decentralized liquid staking protocol says the attack triggered one of the largest DeFi runs in crypto history.
KelpDAO said LayerZero failed to disclose weaknesses and risks inherent in its own technology. The protocol also accused LayerZero of failing to prevent infiltration of its security infrastructure, which it claims let attackers exploit the bridge's alleged weaknesses.
Pellegrino calls the lawsuit meritless
Pellegrino responded that Evercrest, KelpDAO's parent entity, filed a notice of civil claim in British Columbia, Canada, against him and LayerZero. According to CoinDesk: "The claim continues to be meritless." He said he would defend himself in Vancouver.
The lawsuit also names Pellegrino individually, and KelpDAO alleges LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit occurred. Cointelegraph reported that LayerZero did not respond to a request for comment before publication.
A dispute over responsibility since April
A North Korean hack group allegedly attacked KelpDAO's cross-chain bridge on April 22, draining 116,500 rsETH, worth roughly $292 million. The aftershocks spread across stablecoin markets, forcing Aave to borrow $300 million to meet withdrawal demand, and days later the exploit erased $20 billion in total value locked across DeFi.
In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. LayerZero argued the loss was possible because Kelp's bridge relied on a single decentralized verifier network as its only verification path, and it has since recommended using multiple verifier networks.
Kelp has disputed that account. In May, it said its verifier configuration had previously been discussed with LayerZero and confirmed as secure, while accusing LayerZero of failing to adequately warn it about the risks. KelpDAO has since migrated the rsETH bridge to a more secure cross-chain security standard to protect user assets.
Sources: CoinDesk, Cointelegraph
Trading involves risk.
Risk Disclaimer
