KelpDAO has escalated its dispute with cross-chain protocol LayerZero by filing a lawsuit tied to the roughly $292 million exploit that hit its rsETH bridge earlier this year. In the complaint, the restaking and tokenization platform alleges that shortcomings in LayerZero’s security infrastructure helped enable the attack.
According to KelpDAO, LayerZero failed to properly disclose risks in its technology and did not stop attackers from compromising components of its infrastructure. The filing also names LayerZero co-founder and CEO Bryan Pellegrino as a defendant, setting up a legal fight over who—if anyone—bears primary responsibility for the loss.
Key takeaways
- KelpDAO’s lawsuit targets LayerZero and names CEO Bryan Pellegrino over the April 18 rsETH bridge exploit.
- The complaint alleges LayerZero did not disclose key risks and that attackers were able to compromise LayerZero’s infrastructure.
- KelpDAO also claims LayerZero reviewed and endorsed Kelp’s bridge deployment and configuration in writing.
- LayerZero’s prior incident report attributed the theft to compromise of its internal nodes and the subsequent approval of a forged cross-chain message.
- The case reflects a broader pattern in DeFi cross-chain disputes: responsibility is contested between protocol infrastructure failures and application-level design choices.
The lawsuit: allegations of undisclosed risks and infrastructure compromise
KelpDAO said in its filing that LayerZero did not adequately disclose risks associated with its technology and did not prevent attackers from compromising the systems underlying its cross-chain verification process.
The lawsuit further alleges that LayerZero reviewed and supported KelpDAO’s deployment and configuration before the exploit, according to a document made available by KelpDAO. This is a central part of the dispute because it challenges LayerZero’s narrative that the loss was primarily driven by how KelpDAO configured its bridge.
KelpDAO framed the legal action as both a security-focused effort and an attempt to correct what it views as an inaccurate account of the incident. It said holding LayerZero and Pellegrino accountable is necessary to address the harm caused to KelpDAO and to parts of the broader DeFi ecosystem.
LayerZero’s leadership has denied the core allegations. Pellegrino characterized the claim as “meritless” and indicated he would defend the case in Vancouver, signaling that the protocol intends to contest the complaint rather than pursue a settlement immediately.
What happened in April—and why the blame is contested
On April 18, an attack on KelpDAO’s LayerZero-powered bridge led to the theft of 116,500 rsETH, which was valued at about $292 million at the time, according to earlier reporting by Cointelegraph. The loss centered on the way cross-chain messages were verified and approved before funds moved.
LayerZero’s final incident report, as described by Cointelegraph, stated that attackers compromised internal nodes and caused a verifier to approve a forged cross-chain message. In that account, the theft was enabled by the bridge’s reliance on a single decentralized verifier network (DVN) as its only verification path.
In practical terms, once LayerZero’s verifier approved the forged message, Kelp’s bridge released rsETH. LayerZero argued that the risk of this outcome was tied to the bridge architecture—specifically, the lack of a second independent verification step.
LayerZero said it had recommended using multiple DVNs and later stopped serving as the sole required verifier for applications that depend on a single DVN arrangement. That position effectively shifts responsibility toward KelpDAO’s configuration choices, even if LayerZero acknowledges that its infrastructure components were involved.
KelpDAO contests that shift. In May, KelpDAO said its DVN configuration had been discussed with LayerZero and “confirmed as secure,” while accusing LayerZero of failing to adequately warn it about relevant risks. KelpDAO has since announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol, reflecting a move away from the LayerZero-dependent architecture that was implicated in the dispute.
Why configuration decisions matter in cross-chain security
This case highlights a persistent tension in cross-chain protocols: even when a cross-chain platform provides verification infrastructure, the security outcome can depend heavily on how applications select and combine verification paths.
LayerZero’s incident narrative emphasizes that using only one DVN created a structural vulnerability—meaning that if that verification path were compromised, the bridge could still process fraudulent messages. KelpDAO’s counter-narrative focuses on what it says were assurances and endorsements from LayerZero, arguing that the risks were not properly communicated and that LayerZero accepted responsibility for the setup.
For investors and users, the distinction is not academic. Cross-chain incidents rarely fit neatly into a single bucket of “infrastructure failure” versus “application misconfiguration.” Instead, the legal question tends to revolve around whether the infrastructure provider warned partners about known failure modes and whether the integration conformed to what both sides understood to be secure at the time.
That uncertainty is also a practical concern for builders operating in this space: a protocol’s incident report may focus on one set of technical causes, while an application’s complaint may spotlight integration assumptions, documentation, and prior guidance.
What to watch next as the dispute moves into court
With KelpDAO now asking the court to rule on LayerZero’s alleged failures—alongside the decision to include Pellegrino personally—the next phase of the case will likely center on evidence about risk disclosure and integration oversight. KelpDAO’s claims that LayerZero reviewed and endorsed the deployment in writing will be particularly important if the parties present documentary records.
At the same time, LayerZero’s defense will need to reconcile its earlier incident framing—compromised internal nodes and a forged message—with KelpDAO’s argument that the configuration was previously validated. Readers should watch for how each side explains the boundary between verifier-level security and application-level bridge design, because that boundary may determine whether the court treats the incident as primarily an infrastructure problem, a configuration problem, or a combination of both.
Be the first to comment