KelpDAO's developer has filed a lawsuit against LayerZero, alleging negligence and defamation after a $292 million exploit in April.
Summary
- Evercrest Technologies has filed a lawsuit against LayerZero and its co-founder in British Columbia.
- The suit alleges negligence and defamation related to a $292 million exploit from April.
- The exploit is claimed to have originated from malware on a LayerZero developer's device prior to the incident.
KelpDAO's developer, Evercrest Technologies, has initiated legal proceedings against LayerZero Labs and co-founder Bryan Pellegrino, following a significant exploit that resulted in a loss of $292 million from the protocol in April. The lawsuit claims that LayerZero had previously supported the bridge configuration that it later criticized as the cause of the exploit.
On Wednesday, the civil lawsuit was filed in the Supreme Court of British Columbia, targeting LayerZero Labs Ltd., LayerZero Labs Canada Inc., and Pellegrino personally, due to statements made on various platforms. The allegations include negligent misrepresentation, negligence, and defamation, and the lawsuit seeks both aggravated and punitive damages.
KelpDAO on Twitter
The KelpDAO bridge employed a 1-of-1 configuration, which allowed only LayerZero's verifier network to confirm token locking before issuing equivalent tokens on another chain. Evercrest contends that LayerZero directed this setup and had assured them that it was secure. In early 2024, LayerZero had indicated that the draft code was acceptable and instructed Evercrest to use the 1-of-1 configuration. By early 2025, they suggested that even if a verifier was compromised, it would only lead to verification failures.
Moreover, the lawsuit mentions that LayerZero had warned another developer about potential risks associated with its default verifier configurations, but Evercrest claims it was not provided with similar warnings.
The exploit reportedly began with malware installed on a LayerZero developer's computer on March 6, which allowed an attacker to manipulate the verification process. On April 18, the attacker disabled third-party nodes, falsely indicating that 116,500 rsETH had been locked on Unichain, leading to the minting of tokens without proper backing. Evercrest claims to have halted further exploits within an hour of the incident.
Defamation claims arise from LayerZero's post-exploit statements, which criticized the single-verifier setup and suggested it contradicted their recommended multi-DVN model. Pellegrino remarked that reliance on a single DVN was unwise. Following the incident, LayerZero admitted it had erred in allowing a single DVN to handle high-value transactions.
Evercrest is pursuing damages that include a 2,000 ETH contribution to restore the backing of rsETH, over $650 million in withdrawals post-exploit, and a decline in the KERNEL token, which has raised concerns from regulatory bodies.
Pellegrino has stated on social media that the lawsuit is without merit and he intends to defend himself in court. No formal response to the lawsuit has been filed yet, and the claims have not been adjudicated in court.
