KelpDAO sues LayerZero and its CEO, blaming the bridge for letting $292M walk out the door 🚪

KelpDAO has filed a lawsuit against cross-chain protocol LayerZero over the roughly $292 million exploit of its rsETH bridge earlier this year, alleging that failures in LayerZero's security infrastructure contributed to the attack. The complaint, announced Friday, names LayerZero and co-founder and CEO Bryan Pellegrino, and accuses the protocol of failing to disclose risks in its technology or prevent attackers from compromising its infrastructure. KelpDAO also says LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit occurred. "Our number one priority has always been and will remain the security of our users' assets," Kelp wrote. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem." Pellegrino called the claim "meritless" and said he would defend the case in Vancouver. Cointelegraph contacted LayerZero for further comment but did not receive a response before publication.

The dispute stems from an April 18 attack in which 116,500 rsETH, worth about $292 million at the time, were stolen from a LayerZero-powered bridge used by Kelp. In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. The protocol argued the loss was possible because Kelp's bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. With no second independent verifier required, the bridge released the rsETH after LayerZero's verifier approved the forged message. LayerZero said it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.

Kelp has pushed back on LayerZero's account of responsibility. In May, the project said its DVN configuration had previously been discussed with LayerZero and "confirmed as secure," while accusing LayerZero of failing to adequately warn it about the risks. Kelp later announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol. Recovery prospects have dimmed in the months since, with the Kelp DAO hacker reportedly laundering nearly all of the stolen funds, leaving the lawsuit as the principal remaining avenue for restitution.