KelpDAO sues LayerZero over $292 million rsETH bridge hack
Security & Exploits ·
The liquid staking protocol has filed a civil claim in British Columbia against LayerZero and co-founder Bryan Pellegrino, alleging the bridge provider knew about and approved a flawed verification setup before the April exploit.
KelpDAO, a decentralized liquid staking protocol built on Ethereum, has brought a lawsuit against LayerZero and its co-founder Bryan Pellegrino, tying the $292 million rsETH exploit to what it calls undisclosed weaknesses in LayerZero's cross-chain infrastructure. According to Decrypt, the claim was filed by KelpDAO's developer entity, Evercrest, which argues LayerZero put its approval in writing for a single-verifier arrangement without warning of the danger it posed.
The dispute centers on a 1-of-1 DVN configuration on the Unichain bridge, a setup that relied on a lone verification node rather than a distributed set of checks, according to The Block. KelpDAO contends this design choice, combined with a breach of LayerZero's own security infrastructure, gave attackers an opening to drain the bridge.
The April 22 attack, attributed to a North Korean hacking group, removed 116,500 rsETH, then worth roughly $292 million, at a moment when the token represented close to a fifth of its own circulating supply held on the bridge. The fallout rippled beyond KelpDAO: Aave, described as the largest decentralized finance lending pool, had to borrow $300 million to cover a surge in withdrawal demand, and within days the broader shock wiped out $20 billion in total value locked across DeFi, a scale of disruption that drew attention from analysts including those at JPMorgan.
Pellegrino has rejected the claim outright, telling reporters he considers it meritless and that he intends to defend both himself and LayerZero in court in Vancouver, a response noted by CryptoPotato. KelpDAO, for its part, says LayerZero and Pellegrino spent months publicly shifting blame onto the protocol rather than acknowledging responsibility, and that it has since moved rsETH's bridge to a different cross-chain security standard to prevent a repeat.
What remains unresolved is how a British Columbia court will weigh the written record KelpDAO says it holds against LayerZero's public denial, and whether the case will surface further detail on how widely the 1-of-1 DVN configuration was used elsewhere before the exploit. The case adds a legal dimension to a crypto year already marked by one of its largest single hacks and a subsequent DeFi liquidity contraction.