KelpDAO Sues LayerZero and Founder Over $292M rsETH Exploit
The filing asks a British Columbia court to decide which party is liable after compromised LayerZero infrastructure let attackers forge cross‑chain messages that released 116,500 rsETH on April 18.
Overview
- On April 18 attackers drained 116,500 rsETH, worth about $292 million at the time, from KelpDAO’s bridge using forged cross‑chain messages that triggered unbacked minting on Ethereum.
- LayerZero’s post‑mortem says the intrusion began with social engineering on March 6 that gave attackers access to LayerZero nodes, which then fed false blockchain data to its verifier.
- KelpDAO alleges LayerZero reviewed and approved the bridge’s configuration in writing and failed to disclose key risks, while LayerZero says Kelp ran a 1‑of‑1 Decentralized Verifier Network that created a single point of failure.
- After the breach Kelp migrated rsETH bridging to Chainlink CCIP, completed fund recovery tranches by late May, and restored normal minting and redemption functions.
- KelpDAO filed the suit in British Columbia on Sept. 24–25 seeking damages and to settle responsibility; Bryan Pellegrino called the claim meritless and said he will defend the case in Vancouver, and no court has yet ruled on liability.