KelpDAO sues LayerZero, CEO over $292M rsETH bridge exploit

KelpDAO has filed a lawsuit against cross-chain messaging protocol LayerZero and its co-founder and CEO Bryan Pellegrino over the April exploit that drained roughly $292 million from Kelp’s rsETH bridge. The complaint argues that shortcomings in LayerZero’s security infrastructure allowed attackers to compromise the protocol and that LayerZero did not disclose associated risks to Kelp.

LayerZero’s post-incident account said attackers gained control of internal nodes and caused its verifier to approve a forged cross-chain message. According to LayerZero, the loss was enabled because Kelp’s bridge depended on a single LayerZero decentralized verifier network (DVN) as the only verification path; LayerZero has said it recommended using multiple DVNs and subsequently stopped serving as the sole required verifier for applications.

Kelp disputes that narrative, telling Cointelegraph the bridge configuration and risks had been reviewed with LayerZero and “confirmed as secure,” and asserting that LayerZero failed to adequately warn it about the vulnerabilities. The DAO has also announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol.

Pellegrino called the lawsuit “meritless” and said he will defend the case in Vancouver. Cointelegraph reported it reached out to LayerZero for comment but did not receive a response before publication. The legal filing formalizes a months-long disagreement over whether the exploit resulted from a compromise of LayerZero’s infrastructure, Kelp’s bridge setup, or a combination of both.