Key facts
- KelpDAO developer Evercrest Technologies is suing LayerZero and CEO Bryan Pellegrino over the April exploit of the rsETH bridge.
- The lawsuit alleges negligent misrepresentation, negligence, and defamation, seeking damages for the $292 million loss.
- KelpDAO claims LayerZero endorsed the 1-of-1 bridge configuration used in the attack, despite later blaming sole DVN reliance.
- The exploit began with malware on a LayerZero developer's computer, which tampered with nodes to feed false readings to the verifier.
- LayerZero CEO Bryan Pellegrino called the lawsuit 'meritless'.
Evercrest Technologies, the developer behind the KelpDAO restaking protocol, has filed a civil claim against cross-chain protocol LayerZero, its Canadian arm, and co-founder Bryan Pellegrino. The lawsuit, filed in the Supreme Court of British Columbia, alleges negligent misrepresentation, negligence, and defamation following the April exploit that drained $292 million worth of rsETH.
KelpDAO claims that LayerZero provided written endorsement for the exact 1-of-1 bridge configuration that was later blamed for the security failure. According to the filing, LayerZero's verifier network was the sole party confirming token locks, a setup LayerZero had explicitly directed KelpDAO to use in March 2024, assuring them there was "no problem" with the default configuration.
The exploit reportedly began six weeks prior to the fund drain, with an attacker introducing malware onto a LayerZero developer's computer on March 6. This malware tampered with LayerZero's nodes, feeding false readings to its verifier. On April 18, the attacker disabled third-party nodes, causing the verifier to incorrectly report that 116,500 rsETH had been locked on Unichain, enabling the minting of unbacked tokens.
KelpDAO alleges that LayerZero's subsequent incident statement, which blamed reliance on a sole DVN, contradicted its prior recommendations and assurances. It also claims Pellegrino made defamatory statements on social media. Evercrest is seeking aggravated and punitive damages, including a 2,000 ETH contribution to restore rsETH's backing and compensation for over $650 million withdrawn since the exploit, as well as a fall in the KERNEL token.
LayerZero and Pellegrino have dismissed the claims as meritless. Pellegrino stated he would defend himself against the lawsuit in Vancouver. None of the allegations have been tested in court, and no formal response to the claim has been filed.