KelpDAO Sues LayerZero and Co‑Founder Over $292 Million rsETH Exploit

Overview

• The dispute stems from an April 18, 2026 exploit that drained 116,500 rsETH, roughly $292 million, from KelpDAO’s LayerZero‑powered bridge when a forged verification message triggered an Ethereum transfer.
• LayerZero’s investigation says attackers first social‑engineered a developer on March 6, gained session credentials, altered internal RPC nodes and caused its Decentralized Verifier Network (DVN) to sign a false message.
• KelpDAO says LayerZero reviewed and approved the bridge’s configuration in writing, while LayerZero says KelpDAO chose a risky 1‑of‑1 DVN setup that let a single verifier authorize messages without a second check.
• KelpDAO completed technical remediation and asset recovery in May by moving rsETH transfers to Chainlink’s CCIP, recovering remaining funds by May 25, and coordinating with platforms including Aave while contributing 2,000 ETH to the effort.
• The civil claim filed in British Columbia on September 24 raises wider questions for cross‑chain security because LayerZero has since ended support for 1‑of‑1 verifiers and the case could shape who is liable for off‑chain verification failures.