KelpDAO sues LayerZero, CEO over $292M rsETH bridge exploit
KelpDAO says LayerZero endorsed its bridge setup before the attack, while CEO Bryan Pellegrino has dismissed the lawsuit as meritless.
KelpDAO has initiated legal proceedings against LayerZero, the cross-chain protocol, in the aftermath of a significant $292 million exploit of its rsETH bridge. This lawsuit contends that weaknesses in LayerZero’s security infrastructure played a role in the attack. KelpDAO claims that LayerZero did not adequately disclose potential risks associated with its technology or thwart attackers from breaching its infrastructure.
The lawsuit, which also names LayerZero’s co-founder and CEO Bryan Pellegrino, asserts that LayerZero had reviewed and approved KelpDAO's deployment and configuration in writing prior to the exploit. KelpDAO's spokesperson, Kelp, emphasized their commitment to safeguarding users' assets and held LayerZero accountable for the harm they inflicted on the DAO and the broader decentralized finance (DeFi) ecosystem.
Pellegrino responded by dismissing the lawsuit as "meritless" and vowed to defend the case in Vancouver. This lawsuit deepens a longstanding disagreement regarding whether the loss was a result of LayerZero’s infrastructure compromise, KelpDAO's bridge configuration, or a combination of both. LayerZero’s April 18 attack led to the theft of 116,500 rsETH, valued at approximately $292 million at the time, from KelpDAO's LayerZero-powered bridge.
LayerZero's concluding incident report attributed the breach to the compromise of its internal nodes, leading to the approval of a forged cross-chain message. The protocol argued that the loss could have been prevented if KelpDAO's bridge had employed multiple decentralized verification networks (DVN) instead of relying on a single LayerZero DVN.
Despite acknowledging the need for multiple DVNs, LayerZero subsequently ceased acting as the sole verifier for applications. KelpDAO, however, disputed LayerZero’s account of responsibility, asserting that their DVN configuration had been previously reviewed and deemed secure by LayerZero. KelpDAO subsequently announced its intention to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
