- KelpDAO has filed a lawsuit against LayerZero and its CEO Bryan Pellegrino over a $292 million exploit of its rsETH bridge.
- The lawsuit alleges that LayerZero failed to disclose security risks and endorsed the bridge’s configuration before the attack.
- Pellegrino called the claim “meritless” and said he would defend the case in Vancouver.
- The dispute centers on whether the exploit was caused by compromised LayerZero infrastructure or KelpDAO‘s reliance on a single verification path.
KelpDAO sued cross-chain protocol LayerZero and its co-founder and CEO Bryan Pellegrino on Friday, alleging that security failures contributed to the roughly $292 million exploit of its rsETH bridge in April. KelpDAO said that LayerZero failed to disclose risks in its technology and prevented attackers from compromising its infrastructure.
KelpDAO also alleged that LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit. “Our number one priority has always been and will remain the security of our users’ assets,” KelpDAO wrote, adding that it aims to hold LayerZero and Pellegrino accountable for harm caused to the DeFi ecosystem.
Pellegrino called the claim “meritless” and said he would defend the case in Vancouver. The lawsuit escalates a months-long dispute over whether the loss resulted from compromised LayerZero infrastructure, KelpDAO‘s bridge configuration, or both.
The April 18 attack stole 116,500 rsETH, worth about $292 million at the time, from Kelp‘s LayerZero-powered bridge. In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message, arguing that the loss was possible because Kelp‘s bridge relied on a single decentralized verifier network (DVN) as its only verification path. LayerZero stated it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.
Kelp disputed LayerZero‘s account, saying in May that its DVN configuration had been discussed with LayerZero and “confirmed as secure,” while accusing the protocol of failing to adequately warn about risks. Consequently, Kelp announced plans to migrate the rsETH bridge to ChainLink‘s Cross-Chain Interoperability Protocol.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
