KelpDAO sues LayerZero, claims it endorsed setup used in $292 million rsETH exploit

Evercrest Technologies, the company behind KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia on Thursday against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and co-founder Bryan Pellegrino.

The filing alleges negligent misrepresentation, negligence, and defamation tied to the April 18 exploit of 116,500 rsETH, worth approximately $292 million at the time.

"The exploit was not a failure of KelpDAO's systems," the notice of civil claim states. "It was a failure of LayerZero's own security infrastructure."

The filing claims that LayerZero reviewed and endorsed the 1-of-1 decentralized verifier network, or DVN, configuration used by the Unichain bridge that was exploited.

Evercrest alleges LayerZero told it in written communications on Feb. 2, 2024, that there was “no problem” with using the default DVN configuration. On March 21, 2024, LayerZero directed Evercrest to use the same 1-of-1 configuration as another bridge.

The filing says LayerZero later described its DVN infrastructure as having redundancy across multiple locations, along with monitoring and alerts. If a DVN were compromised, LayerZero represented that the most it could do was “fail to verify a message correctly,” according to the claim.

LayerZero warned USDT0

Evercrest alleges LayerZero never warned it that a 1-of-1 configuration using LayerZero’s own DVN posed a security risk or advised it to use multiple DVNs. The filing says LayerZero had warned another developer, USDT0, about risks tied to default DVN configurations before the exploit.

The attack unfolded on April 18 at about 17:35 UTC, according to the claim. Evercrest alleges an attacker had gained access to LayerZero’s security infrastructure after using social engineering to install malware on a LayerZero developer’s computer.

Evercrest said the exploit disrupted KelpDAO’s stablecoin plans, with its sbUSD product later sunset after the attack. Evercrest has also begun migrating rsETH to an alternative cross-chain security standard.

The lawsuit also takes aim at LayerZero’s public response. Evercrest disputes LayerZero’s claim that the configuration “directly contradicts” its recommended multi-DVN model and says Pellegrino publicly blamed the protocol for using a 1-of-1 setup.

Pellegrino disputed the allegations. “The claim continues to be meritless,” he said on X, adding that he would defend himself accordingly.

Evercrest is seeking damages for negligent misrepresentation, negligence and defamation, along with aggravated and punitive damages. It also says KelpDAO users have withdrawn more than $650 million in assets since the exploit.