KelpDAO sues LayerZero and CEO over $292M rsETH hack

KelpDAO filed a lawsuit on Friday against cross-chain protocol LayerZero and its CEO, Bryan Pellegrino, saying failures in LayerZero’s security and written assurances contributed to an April exploit that drained its rsETH bridge of roughly $292 million.

The complaint alleges LayerZero did not disclose risks in its technology, did not prevent attackers from compromising its infrastructure, and had reviewed and endorsed Kelp’s deployment and configuration in writing before the exploit. Kelp said it seeks damages for financial and reputational harm and to correct the public record. “Our number one priority has always been and will remain the security of our users’ assets,” Kelp wrote in the filing.

The theft occurred on April 18, when attackers removed 116,500 rsETH, valued at about $292 million at the time, from Kelp’s LayerZero-powered bridge. In a final incident report, LayerZero said attackers had compromised internal nodes, which led the protocol’s verifier to approve a forged cross-chain message that instructed the bridge to release funds.

LayerZero said the loss was possible because Kelp’s bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. LayerZero said it had recommended using multiple, independent DVNs to reduce the risk of a single compromise and that it stopped acting as the sole required verifier for applications after the incident.

Kelp disputes LayerZero’s account. In May, Kelp said its DVN configuration had been discussed with LayerZero and “confirmed as secure,” and accused the protocol of failing to warn it about the risk of relying on a single verifier. Kelp has said it will migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol and pursue legal remedies against LayerZero and Pellegrino.

Pellegrino called the claim “meritless” and said he will defend the case in Vancouver.

Cross-chain bridges pass messages between blockchains to move assets. Verifiers check those messages and approve transfers. If a verifier approves a forged message, the receiving bridge can release tokens to an attacker’s address.

The lawsuit asserts LayerZero had an obligation to disclose vulnerabilities and to take steps to prevent attackers from compromising its systems. Kelp’s filing seeks to establish LayerZero’s liability for what Kelp describes as failures in security practices and in written assurances about the bridge configuration.