KelpDAO Files Lawsuit Against LayerZero Over $292 Million Exploit

Evercrest Technologies, the company behind KelpDAO, has filed a civil lawsuit against LayerZero Labs, its Canadian affiliate, and CEO Bryan Pellegrino in British Columbia. This legal action stems from an exploit in April that resulted in the loss of 116,500 rsETH, valued at approximately $292 million at the time.

The lawsuit accuses LayerZero of negligent misrepresentation, negligence, and defamation, seeking aggravated and punitive damages. Following the exploit, KelpDAO has reportedly seen over $650 million withdrawn by users, as the incident raised significant concerns about the security of LayerZero's infrastructure.

At the core of the dispute is the security configuration of the bridge, which KelpDAO claims was reviewed and endorsed by LayerZero. The configuration in question utilized a single Decentralized Verifier Network (DVN), which KelpDAO argues created a critical single point of failure. In contrast, LayerZero has maintained that KelpDAO was responsible for the decision to adopt this configuration.

The exploit occurred on April 18 when attackers deceived LayerZero's verifier into approving a fraudulent cross-chain transfer. The incident report from LayerZero attributes the breach to a developer who was manipulated into cloning a malicious GitHub repository, leading to the compromise of LayerZero's RPC environment.

As a result of the exploit, a significant migration of assets has taken place, with nearly $15 billion moving off LayerZero to Chainlink's CCIP. This migration highlights the growing concerns within the crypto community regarding the reliability of cross-chain protocols.

The ongoing lawsuit could set a precedent regarding the responsibilities of infrastructure providers in the crypto space, particularly in cases of cross-chain security failures. As the case unfolds, it may reshape the discourse around security configurations and the liability of providers in future incidents.