KelpDAO Developer Sues LayerZero Over $292M Bridge Exploit

The Anatomy of the $292 Million rsETH Exploit

Evercrest Technologies, operating as the developer behind KelpDAO, has escalated a prolonged public dispute into a formal legal battle by filing a civil claim against LayerZero Labs and co-founder Bryan Pellegrino. The lawsuit focuses on the security breach that occurred on April 18, when attackers drained 116,500 rsETH—representing roughly 18% of the liquid restaking token's circulating supply—worth approximately $292 million at the time. Investigators and subsequent incident reports tied the breach to a subgroup of North Korea's Lazarus Group, which utilized social engineering to compromise internal developer credentials and manipulate remote procedure call (RPC) nodes. This forced reliance on compromised nodes, ultimately allowing attackers to push through a forged cross-chain message that authorized an unbacked token burn and subsequent fund release.

Core Allegations and the Conflict Over Configuration

The legal filing introduces severe claims of negligence, negligent misrepresentation, and defamation against LayerZero and its leadership. According to Evercrest, LayerZero reviewed and endorsed the specific single-verifier (1-of-1 DVN) configuration used by the bridge in writing on multiple occasions prior to the attack. Furthermore, the complaint alleges that LayerZero failed to disclose known technology risks and had actively warned a different developer about similar default configurations while encouraging KelpDAO to proceed. Conversely, LayerZero has fiercely contested these assertions. CEO Bryan Pellegrino has dismissed the lawsuit as entirely meritless, with the protocol maintaining that Kelp's choice of a single-verifier model directly contradicted recommended multi-DVN architectures designed to prevent single points of failure.

Broader Market Implications for DeFi Infrastructure

For executives, investors, and entrepreneurs across the decentralized finance ecosystem, this lawsuit marks a critical turning point regarding accountability. Key implications include:

• Shared Infrastructure Risk: Cross-chain protocols rely heavily on interconnected messaging layers and verifier networks, creating complex chains of responsibility when security fails.
• Legal Precedents in Smart Contracts: Moving technical blame games into formal courts establishes a new frontier where written technical endorsements and developer communications can be scrutinized under civil law.
• Reputational and Financial Fallout: Evercrest claims the exploit and subsequent public blame have inflicted tens of millions of dollars in direct damages, forcing the project to sunset products like sbUSD and migrate rsETH to alternative standards such as Chainlink CCIP.

What Stakeholders Should Watch Next

As the case proceeds in the Vancouver court system, industry participants must monitor several key developments. First, observe how the court evaluates written developer approvals versus standard protocol safety documentation. Second, track the broader industry shift toward mandatory multi-verifier frameworks as cross-chain providers seek to insulate themselves from single-point-of-failure liabilities. Finally, keep an eye on how this dispute impacts user trust and liquidity migrations across competing interoperability networks.

Original source: Decrypt