KelpDAO sues LayerZero over alleged endorsement of $292 million exploit setup

Evercrest Technologies, the company behind KelpDAO, filed a notice of civil claim against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and co-founder Bryan Pellegrino. The filing alleges LayerZero reviewed and endorsed the 1-of-1 decentralized verifier network configuration used by the exploited Unichain bridge. The exploit involved 116,500 rsETH worth approximately $292 million at the time. The filing alleges negligent misrepresentation. It alleges negligence. It alleges defamation. The exploit occurred on April 18 at about 17:35 UTC. Evercrest alleges LayerZero told it in written communications on Feb. 2, 2024, that there was no problem with using the default DVN configuration. The filing says LayerZero directed Evercrest on March 21, 2024, to use the same 1-of-1 configuration as another bridge. The filing says LayerZero later described its DVN infrastructure as having redundancy across multiple locations. The filing says LayerZero also described monitoring and alerts. LayerZero represented that a compromised DVN could at most fail to verify a message correctly, according to the claim. Evercrest alleges LayerZero did not warn it that using a 1-of-1 configuration with LayerZero's own DVN posed a security risk. Evercrest alleges LayerZero did not advise it to use multiple DVNs. The filing says LayerZero had warned another developer, USDT0, about risks tied to default DVN configurations before the exploit. Evercrest alleges an attacker gained access to LayerZero's security infrastructure after using social engineering to install malware on a LayerZero developer's computer. Evercrest said the exploit disrupted KelpDAO's stablecoin plans. Evercrest said it later sunset its sbUSD product after the attack. Evercrest has begun migrating rsETH to an alternative cross-chain security standard. Evercrest disputes LayerZero's claim that the configuration directly contradicted its recommended multi-DVN model. Evercrest says Pellegrino publicly blamed the protocol for using a 1-of-1 setup. Pellegrino called the claim meritless. He said he would defend himself. Evercrest seeks damages for negligent misrepresentation, negligence, and defamation. Evercrest also seeks aggravated and punitive damages. Evercrest says KelpDAO users have withdrawn more than $650 million in assets since the exploit.