KelpDAO sues LayerZero over $292 million rsETH exploit

KelpDAO sued LayerZero over the exploit of its rsETH bridge. The attack on April 18 resulted in the theft of 116,500 rsETH worth about $292 million at the time. KelpDAO alleges that LayerZero failed to disclose risks in its technology. KelpDAO also alleges that LayerZero failed to prevent attackers from compromising its infrastructure. KelpDAO said LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit. The lawsuit names LayerZero co-founder and CEO Bryan Pellegrino. Pellegrino called the claim meritless. Pellegrino said he would defend the case in Vancouver. LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. LayerZero said the bridge relied on a single LayerZero decentralized verifier network as its only verification path. LayerZero said it had recommended using multiple decentralized verifier networks. LayerZero later stopped acting as the sole required verifier for applications. KelpDAO said in May that its configuration had been discussed with LayerZero and confirmed as secure. KelpDAO accused LayerZero of failing to adequately warn it about the risks. KelpDAO later announced plans to migrate the bridge to Chainlink’s Cross-Chain Interoperability Protocol. LayerZero and KelpDAO have disputed responsibility since April. LayerZero did not respond to a request for further comment before publication.