TLDR
- KelpDAO has initiated legal proceedings against LayerZero and CEO Bryan Pellegrino following April’s devastating exploit.
- The security breach resulted in the loss of 116,500 rsETH tokens, valued at approximately $292 million during the incident.
- The lawsuit alleges LayerZero concealed critical security vulnerabilities and had previously validated KelpDAO’s bridge configuration as safe.
- Bryan Pellegrino has dismissed the legal action as unfounded and pledged to contest it in Vancouver court.
- Following the breach, KelpDAO has migrated its rsETH bridge infrastructure to Chainlink’s Cross-Chain Interoperability Protocol.
Restaking protocol KelpDAO has initiated legal proceedings against cross-chain messaging platform LayerZero and its co-founder Bryan Pellegrino following a devastating security breach that compromised its rsETH bridge infrastructure this past spring.
The civil complaint was lodged in British Columbia, Canada, this week, naming both LayerZero Labs and Pellegrino as defendants.
According to KelpDAO’s allegations, the breach occurred due to LayerZero’s failure to disclose critical vulnerabilities within its technology stack. The protocol further contends that LayerZero was unable to prevent malicious actors from infiltrating its core infrastructure.
Timeline of the Security Breach
On April 22, malicious actors executed an attack on KelpDAO’s cross-chain bridge infrastructure, which operated using LayerZero’s underlying technology. The bridge contained nearly 20 percent of all circulating restaked ether at that moment.
The perpetrators successfully extracted 116,500 rsETH tokens. The stolen assets were valued at approximately 292 million dollars at the time of the security incident.
Security analysts have attributed the attack to a North Korean state-sponsored hacking collective. The majority of the misappropriated assets were subsequently laundered through various channels, based on previous reporting.
The breach’s impact extended well beyond KelpDAO’s immediate losses. It triggered cascading effects throughout stablecoin and lending markets.
Aave, which operates the dominant lending protocol in decentralized finance, was forced to secure 300 million dollars in emergency funding. This capital injection became necessary to meet surging withdrawal demands from concerned users.
In less than a week, the exploit triggered a collapse of 20 billion dollars in total value locked throughout the DeFi ecosystem.
Conflicting Narratives on Accountability
Following the breach, LayerZero released a detailed post-mortem analysis. The company disclosed that attackers had successfully penetrated its internal node infrastructure, manipulating its verification system into validating a fraudulent cross-chain message.
LayerZero emphasized that KelpDAO’s bridge architecture depended solely on a single LayerZero verifier network for transaction validation. No secondary independent verification layer existed to provide redundant security.
This architectural weakness allowed the counterfeit message to bypass security checks, resulting in the unauthorized release of funds. LayerZero stated it had previously advised clients to implement multi-verifier architectures and has discontinued serving as the exclusive required verifier for partner protocols.
KelpDAO challenges this characterization. In statements issued in May, the protocol maintained that its verifier architecture had been thoroughly discussed with LayerZero personnel and explicitly validated as secure prior to deployment.
KelpDAO contends that LayerZero failed to adequately communicate the inherent risks associated with the chosen configuration.
The current lawsuit explicitly states that the security breach “was a direct result of LayerZero’s failures.” It further alleges that LayerZero personnel reviewed and formally approved its bridge architecture in documented communications before the incident occurred.
Pellegrino issued a swift response via social media channels. He acknowledged receiving the civil claim filed in British Columbia naming both himself personally and LayerZero Labs.
He characterized the allegations as without merit and announced his intention to vigorously defend against them in Vancouver’s legal system.
Cointelegraph contacted LayerZero for an official statement but had not received a reply by press time.
In response to the breach, KelpDAO has implemented enhanced security measures to safeguard user assets. The protocol has transitioned its rsETH bridge operations to Chainlink’s Cross-Chain Interoperability Protocol infrastructure.
KelpDAO states that establishing an accurate public record represents a key motivation behind the lawsuit, in addition to seeking accountability from LayerZero and Pellegrino for the financial damages. The matter will now proceed through the Canadian judicial system, where both parties will present arguments regarding responsibility for one of the year’s most significant DeFi security failures.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
