KelpDAO Drags LayerZero CEO Bryan Pellegrino to Court Over $292 Million Exploit

KelpDAO also alleges that LayerZero reviewed and endorsed the 1-of-1 DVN configuration used by the affected rsETH bridge. According to the lawsuit, LayerZero told KelpDAO in written communications that there was no problem with using the default DVN configuration and later directed the protocol to use the same configuration as another bridge.

LayerZero has disputed KelpDAO’s account. The company previously argued that KelpDAO’s use of a single DVN created a single point of failure that allowed a forged cross-chain message to pass.

LayerZero infrastructure was compromised

The April 18 attack involved the theft of 116,500 rsETH. LayerZero’s subsequent incident report found that the breach began weeks earlier when an attacker socially engineered a LayerZero developer and obtained session credentials.

The attacker then accessed LayerZero’s RPC cloud environment and compromised internal RPC nodes used by the LayerZero Labs DVN. A denial-of-service attack against an external RPC provider forced the DVN to rely on the compromised infrastructure, allowing it to produce an attestation for a forged cross-chain message.

The single-verifier configuration then became critical. Because no second independent DVN had to approve the transaction, the destination contract accepted the forged attestation and released the rsETH. LayerZero’s report attributed the attack to the DPRK-linked TraderTraitor group, also known as UNC4899, based on investigations by Mandiant, CrowdStrike, and independent researchers.

LayerZero later changed its security stance. The company said its DVN would no longer participate as the sole required verifier on channels and that it would enforce a baseline security configuration.

Pellegrino rejects the lawsuit

Pellegrino has rejected KelpDAO’s allegations and called the lawsuit meritless. He said he intends to defend himself and LayerZero in Vancouver.

The legal dispute follows a public clash between the two projects over responsibility for the exploit. LayerZero has argued that the single-verifier setup allowed the attack to succeed, while KelpDAO has maintained that it relied on LayerZero’s infrastructure and configuration guidance.

LayerZero also apologized in May for its handling of the incident and acknowledged that allowing its DVN to operate as the sole verifier for high-value transactions was a mistake. The company subsequently ended support for 1-of-1 DVN configurations.

KelpDAO has since moved its cross-chain infrastructure away from LayerZero. In May, the protocol announced that it would use Chainlink’s Cross-Chain Interoperability Protocol for rsETH transfers following the exploit.

Source:: KelpDAO Drags LayerZero CEO Bryan Pellegrino to Court Over $292 Million Exploit