LayerZero and CEO face legal action from KelpDAO following $292M rsETH bridge hack
Legal proceedings have been initiated by KelpDAO against LayerZero in connection with a $292 million rsETH bridge hack, with claims that inadequate security measures played a role in the incident.
Legal action has been initiated by KelpDAO against the cross-chain protocol LayerZero in the wake of an approximately $292 million hack targeting its rsETH bridge that occurred earlier in the year, with claims that deficiencies in LayerZero's security systems played a role in enabling the attack.
In a statement released on Friday, KelpDAO asserted that LayerZero did not adequately communicate the risks associated with its technology nor take measures to stop attackers from breaching its infrastructure. The allegations further include claims that LayerZero had examined and provided written approval for its deployment and configuration prior to the security breach.
Bryan Pellegrino, who serves as both co-founder and CEO of LayerZero, has also been named as a defendant in the lawsuit.
Our number one priority has always been and will remain the security of our users' assets. But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem.
KelpDAO
Responding to the allegations, Pellegrino characterized the claim as "meritless" and stated his intention to mount a defense against the case in Vancouver.
The legal proceedings represent an intensification of a dispute that has lasted for months regarding whether the financial loss stemmed from a breach of LayerZero's infrastructure, issues with KelpDAO's bridge configuration, or a combination of both factors.
Cointelegraph reached out to LayerZero seeking additional commentary, but had not received a reply by the time of publication.
Kelp and LayerZero have disputed responsibility since April
The security breach that took place on April 18 led to the unauthorized removal of 116,500 rsETH, which held a market value of approximately $292 million at that point in time, from Kelp's bridge powered by LayerZero technology.
According to LayerZero's final incident analysis, the attackers successfully infiltrated its internal nodes and manipulated its verifier into approving a fraudulent cross-chain message. The company maintained that the loss became possible due to Kelp's bridge depending solely on a single LayerZero decentralized verifier network (DVN) as its exclusive verification pathway.
Because no second independent verifier was mandated, the bridge released the rsETH following the approval of the forged message by LayerZero's verifier. LayerZero indicated that it had previously advised using multiple DVNs and has since discontinued serving as the sole required verifier for applications.
Kelp has challenged LayerZero's version of events regarding accountability. In May, the organization stated that its DVN configuration had been previously reviewed with LayerZero and "confirmed as secure," while simultaneously accusing LayerZero of not providing sufficient warnings about the potential risks. Following these events, Kelp revealed its intentions to transition the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol.