KelpDAO files lawsuit against LayerZero over security setup linked to rsETH exploit

KelpDAO files lawsuit against LayerZero over security setup linked to rsETH exploit
KelpDAO sues LayerZero

A legal dispute is escalating in the crypto infrastructure sector after Evercrest Technologies sued LayerZero over the configuration used on the Unichain bridge tied to the rsETH exploit. The claim centers on whether LayerZero reviewed and endorsed a 1-of-1 DVN setup before the April 18 attack involving 116,500 rsETH, valued at about $292 million.

Highlights

  • Evercrest Technologies files a lawsuit alleging LayerZero's negligent misrepresentation, negligence, and defamation surrounding the exploited Unichain bridge's 1-of-1 DVN configuration.
  • Evercrest claims the April 18 attack resulted in $650 million in asset withdrawals from KelpDAO, extending beyond the 116,500 rsETH directly referenced in the filing.
  • The lawsuit intensifies legal scrutiny on bridge security, validator configuration, and liability related to cross-chain crypto infrastructure and risk controls.

Claims over bridge security review

As first reported by The Block, Evercrest Technologies alleges in a notice of civil claim that LayerZero reviewed and endorsed the 1-of-1 DVN configuration later used by the exploited Unichain bridge.

The filing alleges negligent misrepresentation, negligence and defamation tied to the exploit. Evercrest argues the breach does not stem from KelpDAO’s own systems, and says the failure instead lies in LayerZero’s security infrastructure.

The claim also says LayerZero had warned another developer before the exploit about risks linked to default DVN configurations, but did not give KelpDAO the same warning. The attack occurs on April 18 and results in unauthorized access to LayerZero’s infrastructure, according to the filing.

Financial fallout for KelpDAO and crypto risk controls

Evercrest says the exploit leads to the withdrawal of $650 million in assets from KelpDAO, widening the commercial impact beyond the 116,500 rsETH directly cited in the case. The dispute adds legal pressure to a sector already facing scrutiny over bridge architecture, validator design and third-party security assurances.

The case also highlights how infrastructure reviews and configuration guidance can become central in assigning liability after a crypto exploit. For developers and asset platforms using cross-chain systems, the lawsuit underscores the business and reputational risks tied to security design decisions made before an attack occurs.

Our earlier article examined how financial regulators are stepping up efforts to manage AI-driven risks to markets and critical infrastructure, with a focus on cyber threats and concentrated dependence on major cloud providers. We noted that supervisors in multiple countries are increasingly using existing powers and building their own AI tools to monitor outcomes, enforce controls, and clarify liability, rather than waiting for new legislation.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.