KelpDAO has filed a civil lawsuit against LayerZero and its co-founder Bryan Pellegrino in British Columbia, accusing the bridge provider of security failures behind a $292 million exploit of its rsETH token that occurred in April.
The suit marks KelpDAO's most direct attempt to hold LayerZero accountable after months of public disagreement over what caused the breach. In a statement posted on September 25, KelpDAO alleged that the exploit resulted from LayerZero's failure to disclose weaknesses in its technology and prevent infiltration of its security infrastructure.
Disputed Configuration and Responsibility
KelpDAO stated that LayerZero reviewed and endorsed its deployment and configuration of LayerZero's technology in writing. The protocol directly challenged LayerZero's argument that the attack was isolated to KelpDAO's rsETH configuration due to the use of a 1-of-1 Decentralized Verifier Network, or DVN, arrangement.
Under that setup, LayerZero's own DVN served as the sole verifier, meaning a forged cross-chain message could be accepted without a second independent verifier rejecting it. LayerZero has maintained that it recommended using multiple DVNs to avoid such a single point of failure.
However, KelpDAO pushed back on that account in a May 6 report, arguing that the 1-of-1 configuration was not an unusual setup chosen against LayerZero's guidance. Instead, the protocol claimed the configuration followed LayerZero's official documentation and default deployment practices.
Response and Broader Context
LayerZero CEO Bryan Pellegrino responded within hours on X, confirming that Evercrest, KelpDAO's parent entity, had filed a notice of civil claim in British Columbia. Pellegrino called the claim meritless and stated he would defend himself in Vancouver courts.
According to Cyvers, approximately $293.7 million in rsETH was drained during the exploit, with the attacker moving assets into ETH across Ethereum and Arbitrum. Lending protocols including Aave V3, Compound V3, and Euler were also affected by the incident.
