KelpDAO Sues LayerZero Over $292 Million rsETH Bridge Exploit

Does the lawsuit establish that LayerZero caused the exploit?

No. Evercrest alleges LayerZero negligently misrepresented security risks and endorsed the bridge configuration, while Pellegrino disputes the claims and says he will defend the case.

Orbitrum Investor Impact

Why does the lawsuit matter for LayerZero?

The case creates potential legal and financial exposure over infrastructure that LayerZero itself says was compromised during the attack. Evercrest is seeking damages for negligence, negligent misrepresentation and defamation, plus aggravated and punitive damages.

How did the $292 million exploit happen?

LayerZero's incident report says attackers compromised its internal RPC infrastructure and induced its DVN to attest to a forged cross-chain message. KelpDAO's 1-of-1 verifier configuration meant no second independent DVN was required, allowing 116,500 rsETH to be unlocked.

Did LayerZero endorse KelpDAO's 1-of-1 security configuration?

That is disputed. Evercrest alleges LayerZero reviewed and endorsed the configuration in writing, while LayerZero's incident report says the application owner controlled the security configuration and had changed the affected channel from 2-of-2 to 1-of-1.

What changed after the exploit?

LayerZero says its own DVN now refuses to act as the sole required verifier on a channel and that it rebuilt the compromised operational infrastructure. KelpDAO has also begun migrating rsETH to an alternative cross-chain security standard.

What happens next in the LayerZero lawsuit?

The civil claim will proceed in British Columbia unless the parties resolve it earlier, with responsibility for the exploit and any damages still unresolved.