KelpDAO Operator Sues LayerZero Over $292 Million rsETH Bridge Exploit

Summary

• Evercrest alleges LayerZero endorsed KelpDAO’s single verifier bridge configuration before an exploit drained 116,500 rsETH valued at approximately $292 million.
• The lawsuit challenges Pellegrino’s public remarks and cites disrupted stablecoin plans alongside more than $650 million in user asset withdrawals.
• LayerZero attributes the breach to compromised RPC servers while Evercrest disputes its account of guidance on independent bridge security verification.

KelpDAO operator Evercrest Technologies has sued LayerZero and co-founder Bryan Pellegrino over an exploit involving 116,500 rsETH. Evercrest alleges LayerZero approved the bridge’s security configuration, then publicly blamed KelpDAO for relying on that arrangement.

Evercrest filed its civil claim in the Supreme Court of British Columbia on Thursday, naming two LayerZero companies and Pellegrino. The filing seeks damages for negligent misrepresentation, negligence, and defamation stemming from the April 18 attack.

Also Read: Expert Maps Bitcoin’s Conditional Road to $1 Million by April 2029

Evercrest Disputes LayerZero’s Bridge Security Guidance

The stolen rsETH was worth approximately $292 million when the exploit occurred, according to the filing. Evercrest argues LayerZero gave assurances about the bridge’s security setup without explaining the risks of relying on one verifier.

According to the claim, LayerZero told Evercrest in February 2024 that its default verifier configuration presented “no problem.” Evercrest alleges LayerZero then directed it toward another bridge’s one-verifier setup in March 2024.

A decentralized verifier network, or DVN, checks cross-chain messages before a bridge releases assets to users. KelpDAO’s affected bridge required approval from only one DVN, which LayerZero operated, according to the filing.

Evercrest claims LayerZero described its DVN infrastructure as having monitoring, alerts, and redundancy across multiple locations. However, it alleges LayerZero never warned that a single DVN could leave the bridge exposed if compromised.

The filing also claims LayerZero warned another developer, USDT0, about risks associated with default DVN configurations. Evercrest argues LayerZero should have given KelpDAO comparable guidance before the attack occurred.

Lawsuit Challenges Pellegrino’s Public Remarks

Evercrest also disputes LayerZero’s public claim that KelpDAO’s configuration contradicted its recommended model using multiple DVNs. The company alleges Pellegrino blamed KelpDAO for choosing an arrangement that LayerZero had previously reviewed and endorsed.

Those remarks form part of Evercrest’s defamation claim, while its other claims concern LayerZero’s security guidance. The filing seeks aggravated and punitive damages alongside compensation for the alleged losses.

Evercrest says the exploit disrupted KelpDAO’s stablecoin plans and led it to sunset its sbUSD product. It has also begun migrating rsETH to another cross-chain security standard, according to the filing.

Additionally, Evercrest claims users have withdrawn more than $650 million in assets from KelpDAO since the exploit. According to Pellegrino’s response on X, he considers the lawsuit meritless and intends to defend himself.

How the April rsETH Bridge Exploit Unfolded

As 36Crypto reported in April, the attack involved the verification infrastructure supporting KelpDAO’s rsETH bridge. LayerZero’s subsequent incident report describes an attacker gaining access to its RPC environment through a developer’s compromised computer.

According to LayerZero, the attacker manipulated responses from internal servers while disrupting an external data provider. Its DVN then approved a forged message, allowing the bridge to release the rsETH without another verifier’s approval.

LayerZero attributes the scale of the loss partly to the bridge’s reliance on a single verifier. Evercrest disputes LayerZero’s account of its earlier guidance, leaving that issue for the court to examine.

Also Read: CBI Arrests Mahadev Betting Suspect as Dubai Money Trail Draws Scrutiny