Kelp DAO Initiates Legal Action Against LayerZero Over $292 Million Exploit Incident

Evercrest Technologies, which operates the liquid restaking platform Kelp DAO, has filed a lawsuit against LayerZero Labs and its CEO Bryan Pellegrino in the Supreme Court of British Columbia. The legal action, revealed in a notice of civil claim dated September 24, targets the catastrophic exploit of the rsETH LayerZero bridge that occurred in April. This case could have significant implications not just for the involved parties but for the broader decentralized finance (DeFi) community, particularly due to the lessons it is likely to reveal about the vulnerabilities within blockchain systems.

The Basis of the Lawsuit

Kelp has charged that the exploit was directly linked to failures on LayerZero's part, asserting that the company had previously "reviewed and endorsed" Kelp's deployment procedure. The April 18 exploit saw a staggering amount of 116,500 rsETH siphoned off, equating to around $292 million at the time, without backing from any actual deposits. Such a breach highlights ongoing concerns about security in DeFi, where the promise of high returns often masks underlying vulnerabilities. Following the breach, LayerZero connected the attack to North Korea's notorious Lazarus Group, which is known for its sophisticated cyber operations. Kelp’s claim points to negligent misrepresentation, negligence, and defamation, stating that the resulting damage amounts to "tens of millions of dollars," despite not specifying an exact figure for the claims made.

Details of the Allegations

The core of Kelp's allegations revolves around the verification mechanism of the bridge. LayerZero utilizes Decentralized Verifier Networks (DVNs) to ensure that tokens are either locked or burned on one chain before corresponding tokens are created on another. However, as Kelp asserts, the bridge that was exploited only required approval from a single DVN, a setup that LayerZero managed. This raises significant questions about whether a one-verifier system is enough to safeguard valuable assets in high-stakes environments like DeFi. If you're working in this space, consider how often single points of failure are overlooked — they can be a fatal flaw.

Moreover, Kelp claims LayerZero supported this 1-of-1 verification setup in several written communications from early 2024, including recommendations to replicate configurations from other single-verifier scenarios. Interestingly, Kelp alleges that while LayerZero advised another developer about potential risks in default settings, no such warnings were communicated to them. In an April 19 statement, LayerZero mentioned it had provided "best practices" regarding DVN diversification to KelpDAO, a claim Kelp disputes. The disparity in these accounts underscores a critical gap in communication and responsibility when multiple parties are involved in complex ecosystems.

The exploit itself originated on March 6 when a social engineering attack enabled a hacker to install malware on a LayerZero developer’s machine, leading to tampering with LayerZero’s RPC nodes. Consequently, an unauthorized message was approved by the DVN. This sequence of events not only reveals how interconnected systems can collapse under pressure but also serves as a cautionary tale for other platforms regarding software security and personnel training.

Claims of Defamation

Pellegrino faces personal liability amidst claims linked to communications made on platforms such as X and Telegram. One contentious point is a statement published by LayerZero on April 19, which asserted that Kelp's system “directly contradicts the multi-DVN redundancy model” recommended to all partners, further fueling Kelp's defamation allegations. Here’s the thing: words matter, especially in high-stakes industries where reputations are at risk. The implications of such statements could extend beyond this case to set precedents for how companies communicate vulnerabilities and handle public relations crises.

Following the exploit, Kelp has reported that over $650 million has been withdrawn from its platform, factoring in current ETH values, alongside an investment of 2,000 ETH to help stabilize the backing of rsETH. This outflow provides a stark reminder of how quickly user trust can be eroded when security is compromised.

LayerZero's Defense

Pellegrino has responded to the filing, asserting on X that "the claim continues to be meritless" and that he will mount a defense in Vancouver. LayerZero maintains that Kelp shifted from using multi-verifier defaults to a single verifier independently, arguing that Kelp cannot shift liability onto them when they made that choice. This argument is disputed in Kelp's filing, which emphasizes that LayerZero’s DVNs should refuse to act as a sole attester. As a result of the exploit, Kelp announced plans to transition rsETH to Chainlink’s cross-chain protocol, with that migration currently in process. This pivot could be seen as a strategic move to enhance security protocols, but it also raises questions. Will users trust Kelp again, or will they view this as merely another reaction to crisis management?

Kelp has expressed a readiness to confront these allegations in court, emphasizing their commitment to seeking justice. Given the stakes in this case, the outcome could ultimately shift how both parties and potentially other companies in the DeFi ecosystem approach partnerships and risk management.

Implications for the Future

This case may be more significant than it looks. If the court rules in favor of Kelp, it might set a precedent for accountability in decentralized finance, where liability is often murky. The entire industry could face consequences, including tighter regulations and a renewed focus on operational transparency. Crypto platforms may rethink how they communicate risks, tighten security protocols, and, importantly, enhance education around best practices for users.

On the flip side, a ruling in favor of LayerZero could embolden companies to adopt riskier validation setups without fear of repercussion, under the assumption that users will accept any failures as the cost of doing business in the blockchain space. And yet, the most critical outcome may be the amplified discourse surrounding security in decentralized finance, pushing all actors in the space to advocate for stronger systems and clearer communication. This ongoing saga serves as a critical case study, one that many will watch closely as it unfolds.

Related Listen: How DeFi Remains Secure in a World of Always-On AI Hacks: Uneasy Money