KelpDAO Sues LayerZero Over $292 Million rsETH Bridge Exploit

KelpDAO sues LayerZero and CEO Bryan Pellegrino over the $292 million rsETH bridge exploit involving 116,500 rsETH.

KelpDAO has filed a civil lawsuit against LayerZero and its co-founder and CEO Bryan Pellegrino over the April exploit of its rsETH bridge, seeking to establish responsibility for an incident that resulted in the loss of 116,500 rsETH valued at about $292 million.

According to Coin Bureau, KelpDAO alleges that LayerZero failed to disclose certain risks in its technology and that a 1-of-1 verifier configuration left the bridge vulnerable to the attack. The dispute also centers on whether LayerZero had reviewed and endorsed KelpDAO's deployment and configuration before the incident.

The lawsuit was filed in British Columbia, adding a legal dispute to months of disagreement over how the attack occurred and which parties should bear responsibility.

Dispute Centers on Single-Verifier Configuration

The April 18 attack targeted KelpDAO's rsETH bridge, which used LayerZero's cross-chain infrastructure. LayerZero's own incident report said the bridge was configured with a single Decentralized Verifier Network, or DVN, creating a single point of failure.

According to LayerZero, the attackers compromised infrastructure associated with its verification system after using social engineering to gain access to a developer's credentials. The attackers subsequently manipulated RPC infrastructure and produced false information that allowed a forged cross-chain message to be accepted.

Chainalysis separately described the incident as an attack on off-chain infrastructure rather than a conventional smart-contract vulnerability. Its analysis said the attackers compromised internal RPC nodes and disrupted external infrastructure, allowing a single-verifier setup to validate a false cross-chain message.

KelpDAO's lawsuit disputes how responsibility for those conditions should be allocated. The DAO alleges that LayerZero had not adequately disclosed relevant technological risks and had failed to prevent attackers from compromising infrastructure used by the verification system. Those allegations remain claims in the civil proceeding and have not been adjudicated.

Pellegrino Rejects KelpDAO's Claims

Pellegrino has rejected the allegations, describing the lawsuit as “meritless” and saying he intends to defend himself and LayerZero in Vancouver. His position contrasts with KelpDAO's account of the bridge configuration and the role of LayerZero's infrastructure in the incident.

LayerZero previously maintained that the incident was isolated to KelpDAO's rsETH configuration and resulted directly from the use of a single-DVN setup. The company said affected RPC nodes were subsequently deprecated and replaced.

The dispute therefore extends beyond the theft itself to questions about configuration choices, infrastructure security and the responsibilities of technology providers and applications using cross-chain messaging systems.

KelpDAO Moves to a Different Bridge

KelpDAO has also taken steps to change its bridge infrastructure markets following the exploit. The DAO said it was migrating rsETH to a safer cross-chain bridge as it works to protect users and address the consequences of the attack.

The civil case now places the competing accounts before a court in British Columbia. The proceedings will determine how the parties' allegations and defenses are treated under the legal process.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.