TLDR
- KelpDAO filed a lawsuit in British Columbia against LayerZero and co-founder Bryan Pellegrino over the April 18 rsETH exploit.
- The attack drained 116,500 rsETH, worth about $292 million, from Kelp’s bridge.
- Kelp says LayerZero failed to disclose risks and approved its bridge setup in writing.
- LayerZero blames Kelp’s single-verifier setup, and Pellegrino called the lawsuit meritless.
- Kelp has since moved rsETH to Chainlink CCIP and finished its recovery plan in May.
KelpDAO has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino in British Columbia, Canada. The case concerns the April 18 exploit that drained 116,500 rsETH worth about $292 million.
Kelp announced the filing on September 24. Evercrest Technologies Inc., the legal entity behind Kelp, brought the action.
The complaint alleges LayerZero failed to disclose weaknesses and risks in its technology. It also claims LayerZero failed to stop attackers from breaking into security infrastructure used by its verifier. No court has ruled on these claims.
Pellegrino disputes the case and called the claims “meritless.” The lawsuit names both LayerZero and Pellegrino personally.
Dispute Over the Bridge Setup
Part of the case focuses on how Kelp’s rsETH bridge was configured. Kelp says LayerZero reviewed and approved the setup in writing before the attack.
LayerZero tells a different story. It said Kelp used a 1-of-1 Decentralized Verifier Network, or DVN, meaning no second verifier could reject a false message. The company said it had recommended using multiple verifiers.
Kelp has said its bridge followed LayerZero’s documented defaults. LayerZero maintains that Kelp manually switched to the single-verifier setup. Pellegrino said Kelp first used multi-DVN defaults before making the change.
How the Attack Happened
LayerZero’s final report, released in May, confirmed that attackers broke into infrastructure run by LayerZero Labs. The intrusion began on March 6, when an attacker tricked a LayerZero developer and obtained session credentials.
The attacker then altered internal RPC nodes used by the LayerZero Labs DVN. On April 18, those nodes fed false blockchain data while attackers hit outside RPC providers with a denial-of-service attack.
The DVN then signed a forged message. Kelp’s Ethereum bridge released 116,500 rsETH even though no matching burn had happened on the source chain.
A second attempt targeted another 40,000 rsETH, worth roughly $95 million to $100 million. Kelp paused its contracts about 46 minutes after the first drain, which stopped it.
Chainalysis described the event as an attack on off-chain verification infrastructure, not a flaw in Kelp’s token contract. Blockaid found that the lack of a second verifier allowed the forged message through.
LayerZero and several researchers linked the attack to TraderTraitor, a North Korea-linked group tied to Lazarus. Mandiant and CrowdStrike reached the same finding.
After the attack, LayerZero ended support for 1-of-1 DVN setups. It moved affected apps toward multi-verifier setups.
In May, Kelp moved rsETH cross-chain transfers from LayerZero to Chainlink CCIP. By May 25, it had transferred the final 20,373.72 rsETH needed for its recovery plan, and minting, redemptions and rewards resumed.
The recovery involved Aave and other platforms because the attacker used stolen rsETH as collateral. Kelp committed 2,000 ETH to the effort.
The case now moves through British Columbia’s court process. Under provincial rules, a defendant generally has 21 days to respond after service in Canada, 35 days in the U.S., or 49 days elsewhere.
Pellegrino has said he will defend himself and LayerZero in Vancouver.
The post KelpDAO Sues LayerZero Over $292 Million rsETH Exploit appeared first on Blockonomi.
