KelpDAO Sues LayerZero Over $292 Million Bridge Exploit, Alleging Security Failures

KelpDAO has officially initiated legal proceedings against cross-chain protocol LayerZero, seeking accountability for the massive $292 million exploit of its rsETH bridge that occurred earlier this year. The lawsuit, filed on Friday, centers on KelpDAO’s assertion that critical failures within LayerZero’s security infrastructure were a direct contributing factor to the attack, which resulted in the theft of approximately 116,500 rsETH tokens.

In a public statement, KelpDAO detailed its allegations, stating that LayerZero had failed to adequately disclose inherent risks associated with its technology. Furthermore, the decentralized finance (DeFi) platform claims that LayerZero did not implement sufficient preventative measures to stop attackers from compromising its infrastructure. Adding a significant layer to the legal battle, KelpDAO also alleges that LayerZero had, in writing, reviewed and endorsed the specific deployment and configuration of the rsETH bridge prior to the exploit. The lawsuit further names LayerZero co-founder and CEO, Bryan Pellegrino, as a defendant.

"Our number one priority has always been and will remain the security of our users’ assets," a spokesperson for KelpDAO stated. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem."

Reacting to the lawsuit, Bryan Pellegrino dismissed the claims as "meritless" and indicated his intention to vigorously defend the case in Vancouver, where the legal action is reportedly being pursued. This legal escalation underscores a prolonged and increasingly contentious dispute between the two entities over the precise cause of the exploit. The core of the disagreement lies in whether the loss was primarily due to a compromise of LayerZero’s infrastructure, flaws in KelpDAO’s bridge configuration, or a combination of both.

Cointelegraph reached out to LayerZero for further comment on the lawsuit and the allegations but had not received a response by the time of publication.

A Dispute Brewing Since April

The incident that triggered this legal action took place on April 18th, when attackers successfully exploited KelpDAO’s bridge, a mechanism powered by LayerZero’s cross-chain communication technology. The stolen 116,500 rsETH represented a substantial loss, valued at roughly $292 million at the time of the breach.

Following the exploit, LayerZero released an incident report that presented its findings on the attack. In its report, LayerZero asserted that attackers had managed to compromise its internal nodes, which subsequently led to its verifier approving a forged cross-chain message. The protocol argued that the success of the attack was facilitated by KelpDAO’s bridge architecture, which relied on a single LayerZero Decentralized Verifier Network (DVN) as its sole verification pathway. According to LayerZero’s analysis, the absence of a secondary independent verifier meant that once the single DVN approved the forged message, the bridge automatically released the rsETH, making it vulnerable. LayerZero also stated that it had previously recommended the use of multiple DVNs and had subsequently adjusted its services to no longer serve as the sole required verifier for applications utilizing its technology.

However, KelpDAO has consistently contested LayerZero’s narrative regarding responsibility. As early as May, KelpDAO publicly stated that its DVN configuration had been thoroughly discussed and "confirmed as secure" with LayerZero. In its counter-narrative, KelpDAO accused LayerZero of failing to provide adequate warnings about the potential risks associated with its infrastructure. In the wake of the exploit and the ongoing dispute, KelpDAO announced its intention to migrate its rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol (CCIP), signaling a strategic move to enhance security and diversify its reliance on third-party bridging solutions.

The lawsuit filed by KelpDAO marks a significant turning point in the ongoing saga, moving the dispute from the realm of public statements and technical analyses into formal legal arbitration. The outcome of this legal battle could have far-reaching implications for the responsibilities and liabilities of cross-chain infrastructure providers within the decentralized finance ecosystem, potentially setting precedents for how security vulnerabilities and resulting financial losses are addressed. The DeFi community will be closely monitoring the proceedings as they unfold, seeking clarity on the accountability of critical infrastructure providers in safeguarding digital assets.