KelpDAO has filed a lawsuit against cross-chain protocol LayerZero and co-founder Bryan Pellegrino following a $292 million exploit of its rsETH bridge earlier this year. The lawsuit alleges that LayerZero failed to disclose risks in its technology and prevent attackers from compromising its infrastructure.
According to KelpDAO, LayerZero had reviewed and endorsed its deployment and configuration in writing before the attack. "Our number one priority has always been and will remain the security of our users' assets," KelpDAO stated in a Friday announcement. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem."
Pellegrino characterized the claim as "meritless" and said he would defend the case in Vancouver.
Attack and Disputed Responsibility
The April 18 attack resulted in the theft of 116,500 rsETH from Kelp's LayerZero-powered bridge. LayerZero's incident report stated that attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message.
LayerZero argued that the loss occurred because Kelp's bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. With no second independent verifier required, the bridge released the rsETH after LayerZero's verifier approved the forged message.
LayerZero said it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.
KelpDAO's Counterargument
KelpDAO has disputed LayerZero's account of responsibility. In May, it said its DVN configuration had previously been discussed with LayerZero and "confirmed as secure," while accusing LayerZero of failing to adequately warn it about the risks.
KelpDAO subsequently announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol, escalating a months-long dispute over responsibility for the loss.
