Allegations of Protocol Negligence and Delayed Response
KelpDAO has filed a lawsuit in British Columbia against LayerZero and its CEO Bryan Pellegrino regarding the April 18 exploit that drained 116,500 rsETH tokens valued at approximately $292 million. The legal action alleges that vulnerabilities in LayerZero’s cross-chain messaging protocol enabled the theft, which KelpDAO claims resulted from inadequate security measures and negligence in protocol design. The suit seeks damages and accountability for the losses incurred by users of KelpDAO’s rsETH product.
Breaking news
Solana Sandwich Bots Extract $29.7 Million, Mostly Targeting Pump.fun
South Korean Bank Launches Bitcoin-Backed Corporate Lending Program
Standard Chartered Expands Crypto Custody Services to Singapore
Hardware Implant Discovered in Crypto Wallet Security InvestigationThe exploit occurred when attackers manipulated LayerZero’s omnichain infrastructure to mint unauthorized rsETH tokens, which were then exchanged for other assets and withdrawn from liquidity pools. KelpDAO asserts that despite prior audits and known risks associated with cross-chain bridges, LayerZero failed to implement sufficient safeguards against replay and spoofing attacks. The lawsuit highlights internal communications allegedly showing that LayerZero was aware of potential exploit vectors but did not act to mitigate them before the incident.
What Role Did KelpDAO’s Own Risk Management Play in the Incident?
KelpDAO’s legal filing claims that LayerZero’s architecture allowed attackers to forge valid cross-chain messages by exploiting a flaw in how message nonces were validated across chains. This enabled the unauthorized minting of rsETH on Ethereum, which was then swapped for ETH and other tokens via decentralized exchanges. The lawsuit states that KelpDAO detected the anomaly within hours but was unable to freeze the funds due to the decentralized nature of the protocol. It further alleges that LayerZero delayed public disclosure and did not offer timely technical assistance during the aftermath, exacerbating user losses.
While KelpDAO positions itself as a victim of LayerZero’s technical failure, the lawsuit acknowledges that KelpDAO chose to integrate rsETH with LayerZero’s protocol despite known risks in the cross-chain bridge space. However, KelpDAO argues that it relied on LayerZero’s security certifications and audit reports, which it claims misrepresented the protocol’s resilience. The suit contends that had LayerZero disclosed the vulnerability earlier, KelpDAO could have paused migrations or warned users, potentially preventing the full scale of the exploit.
What is rsETH and how was it affected in the exploit? rsETH is a liquid staking token representing staked Ethereum issued by KelpDAO. In the exploit, attackers minted 116,500 fraudulent rsETH tokens, which were then sold for real assets, diluting the value of legitimate holdings and causing a $292 million loss.
Frequently Asked Questions
Did LayerZero admit fault or offer compensation after the exploit? LayerZero has not publicly admitted liability for the exploit. While it conducted a post-mortem and implemented patches, it has not offered direct compensation to affected users, prompting KelpDAO to pursue legal action for damages.
Could this lawsuit affect other projects using LayerZero’s technology? Yes, the outcome may set a precedent for how liability is assigned in cross-chain exploits. If KelpDAO succeeds, other projects relying on LayerZero might face increased scrutiny or legal exposure over security shortcomings in integrated protocols.
