Key Points
- Legal proceedings have been initiated by KelpDAO against LayerZero and CEO Bryan Pellegrino following the April security breach.
- The security incident resulted in the loss of 116,500 rsETH tokens, valued at approximately $292 million during the attack.
- KelpDAO alleges that LayerZero neglected to reveal significant security vulnerabilities and had previously validated the bridge configuration as safe.
- Pellegrino has dismissed the legal action as without merit and intends to contest it in Vancouver court proceedings.
- Following the incident, KelpDAO has transitioned its rsETH bridge infrastructure to Chainlink’s Cross-Chain Interoperability Protocol.
In a significant legal development, KelpDAO has initiated litigation against LayerZero, a cross-chain protocol provider, along with co-founder Bryan Pellegrino, following a devastating security breach that compromised its rsETH bridge infrastructure during the spring.
The legal filing was submitted this week in British Columbia, Canada, targeting both the protocol company and Pellegrino personally.
According to KelpDAO’s allegations, the security compromise occurred due to LayerZero’s failure to properly disclose critical vulnerabilities within its technological framework. The protocol further contends that LayerZero did not prevent malicious actors from penetrating its infrastructure.
Details of the Security Breach
The incident unfolded on April 22, when malicious actors exploited KelpDAO’s cross-chain bridge infrastructure, which operated using LayerZero’s underlying technology. During this period, the bridge secured nearly twenty percent of all circulating restaked ether tokens.
Hackers successfully extracted 116,500 rsETH tokens from the protocol. The stolen digital assets carried an estimated value of approximately 292 million dollars at the moment of the breach.
Intelligence reports have connected this incident to North Korean state-sponsored hacking operations. The majority of the misappropriated assets were subsequently laundered through various channels, as documented in previous reporting.
The impact of this security breach extended far beyond KelpDAO’s immediate losses. The incident triggered widespread disruption throughout stablecoin ecosystems.
Aave, which operates the most substantial lending platform in the decentralized finance sector, was forced to secure 300 million dollars in emergency funding. These resources were necessary to accommodate a massive surge of users attempting to withdraw their holdings.
In the immediate aftermath, the security breach contributed to the elimination of 20 billion dollars in aggregate value locked throughout various DeFi platforms.
Conflicting Accounts of Accountability
Following the security compromise, LayerZero released a comprehensive incident analysis. The organization stated that attackers successfully infiltrated its internal node infrastructure, manipulating its verification system into authorizing a fraudulent cross-chain transaction.
LayerZero emphasized that KelpDAO’s bridge architecture depended solely on a single LayerZero verifier network for transaction validation. The system lacked any secondary, independent verification layer required to authenticate cross-chain operations.
Due to this solitary approval mechanism, the counterfeit message was processed and the assets were transferred. LayerZero indicated it had previously advocated for implementing multiple verification layers and has subsequently ceased functioning as the exclusive required verifier for partner protocols.
KelpDAO challenges this characterization. In May, the protocol asserted that its verification architecture had been thoroughly discussed with LayerZero representatives and received explicit security approval during those consultations.
KelpDAO maintains that LayerZero failed to adequately communicate the inherent risks associated with that particular configuration structure.
In the recently filed legal action, KelpDAO explicitly states that the security breach “was a direct result of LayerZero’s failures.” The lawsuit further alleges that LayerZero conducted a review and provided written endorsement of the bridge configuration prior to the attack.
Pellegrino issued an immediate response through social media channels. He acknowledged that the civil claim was filed in British Columbia naming both himself and LayerZero as defendants.
He characterized the claim as lacking substantive merit and indicated his intention to mount a vigorous defense in Vancouver court proceedings.
Cointelegraph attempted to obtain commentary from LayerZero representatives but had not secured a response by press time.
In the months following the attack, KelpDAO reports implementing enhanced security measures to safeguard user assets. The protocol has migrated its rsETH bridge operations to Chainlink’s Cross-Chain Interoperability Protocol infrastructure.
KelpDAO states that establishing an accurate public record represents a key objective behind filing the lawsuit, in addition to pursuing accountability from LayerZero and Pellegrino for the sustained financial damages. The legal matter now advances to Canadian judicial proceedings, where both parties will present arguments regarding the causation of one of this year’s most substantial DeFi security incidents.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
