KelpDAO sues LayerZero over rsETH bridge exploit losses

Traders Union
All News
Crypto
KelpDAO sues LayerZero over exploit

Highlights

KelpDAO filed a lawsuit against LayerZero and CEO Bryan Pellegrino, alleging undisclosed technology risks and accountability for a $292 million rsETH bridge exploit.
The April 18 attack resulted in the theft of 116,500 rsETH after attackers compromised LayerZero's nodes and exploited reliance on a single decentralized verifier network.
KelpDAO plans to migrate its rsETH bridge to Chainlink’s protocol, signaling shifting security expectations and standards in the crypto bridge ecosystem.

Claims over bridge security and accountability

As reported by Cointelegraph, KelpDAO says it filed suit against cross-chain protocol LayerZero and co-founder and CEO Bryan Pellegrino, alleging the company failed to disclose technology risks and did not prevent attackers from compromising its infrastructure.

Kelp says LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit. In a statement cited in the dispute, Kelp says protecting user assets remains its top priority, but that it also wants to hold LayerZero and Pellegrino accountable for damage caused to the protocol and the wider DeFi ecosystem.

Pellegrino calls the lawsuit meritless and says he will defend the case in Vancouver. LayerZero did not provide further comment before publication, while the case deepens a months-long argument over whether the losses stem from LayerZero’s systems, KelpDAO’s bridge setup, or a combination of both.

April attack reshapes cross-chain risk debate

The April 18 attack led to the theft of 116,500 rsETH, valued at about $292 million at the time, from Kelp’s LayerZero-powered bridge. In its final incident report, LayerZero says attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message.

LayerZero argues the bridge was vulnerable because it relied on a single LayerZero decentralized verifier network, or DVN, as its only verification path. Without a second independent verifier, the bridge released rsETH after the forged message received approval, and LayerZero says it had recommended using multiple DVNs before later ceasing to act as the sole required verifier for applications.

Kelp has rejected LayerZero’s version of events since May, saying its DVN configuration had been discussed with LayerZero and confirmed as secure. Kelp later said it planned to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol, a move that underscores how the exploit is influencing security expectations across the crypto bridge sector.

Our earlier article on Weiss Ratings’ crypto portfolio services outlined how the firm markets model-driven coin selection and market-timing strategies to help investors seek returns beyond Bitcoin. We noted that these products emphasize exposure to higher-risk altcoins—often trading on decentralized exchanges—while presenting risk management and timing signals as key tools to navigate volatility.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.