Particle.news

KelpDAO Sues LayerZero and CEO Over $292 Million rsETH Bridge Exploit

The court case asks a judge to decide who is legally responsible for a forged cross‑chain message that released 116,500 rsETH and could change how providers are held to account for verifier infrastructure.

Overview

  • Evercrest Technologies, KelpDAO’s developer, filed a notice of civil claim in British Columbia on Thursday seeking relief from LayerZero Labs, its Canadian unit, and co‑founder Bryan Pellegrino.
  • Investigations show attackers first gained access to a LayerZero developer on March 6 and then poisoned LayerZero‑operated RPC nodes so the verifier signed a forged message that caused 116,500 rsETH to be released in April.
  • The dispute in court centers on whether LayerZero approved a risky single‑verifier (1‑of‑1) Decentralized Verifier Network setup in writing or whether Kelp chose that configuration, with LayerZero now banning single‑verifier use for high‑value channels.
  • Security firms and LayerZero have attributed the operation to TraderTraitor, a group tied to North Korea’s Lazarus, and the exploit forced emergency moves across DeFi including Aave borrowing and large drops in total value locked.
  • Evercrest’s claim pleads negligent misrepresentation, negligence and defamation, seeks aggravated and punitive damages for recapitalization and reputational harms, and the defendants have the standard response window under British Columbia civil rules.