KelpDAO Files Lawsuit Against LayerZero Over Major Exploit

KelpDAO has initiated legal action against LayerZero and its co-founder Brian Pellegrino, claiming that undisclosed vulnerabilities in the cross-chain lending protocol led to a staggering $292 million hack.

KelpDAO alleges negligence in the cross-chain protocol that resulted in a $292 million exploit

According to a statement from KelpDAO, the exploit on April 22 resulted in the theft of 116,500 rsETH, significantly impacting the decentralized finance (DeFi) sector and contributing to a liquidity crisis that saw $20 billion vanish from DeFi deposits.

“The exploit was a direct result of LayerZero’s failures, including a failure to disclose weaknesses and risks inherent in LayerZero’s own technology,” KelpDAO stated.

The decentralized liquid staking protocol on Ethereum accused LayerZero of not safeguarding its security measures, which allegedly allowed attackers to exploit the weaknesses of the universal bridge.

“Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures,” KelpDAO added.

Pellegrino quickly responded, asserting that the lawsuit is baseless and that he will defend himself and LayerZero in a British Columbia court. “Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ (LayerZero),” he said. “The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.”

The hack is believed to have been executed by a North Korean cyber group, which targeted KelpDAO’s cross-chain bridge on the day of the incident. At that time, KelpDAO was managing nearly 20% of the circulating supply of the restaked token, leading to the significant loss of funds. Following the attack, the repercussions were felt across stablecoin markets, prompting Aave, a leading DeFi lending platform, to borrow $300 million to satisfy user demands for asset withdrawals. Subsequently, the exploit wiped out $20 billion in total value locked (TVL) in the DeFi space, highlighting ongoing structural vulnerabilities, as noted by experts, including those at JPMorgan.

In response to the incident, KelpDAO has taken measures to secure user assets, including migrating its rsETH bridge to a more robust cross-chain security standard.

“But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem,” KelpDAO emphasized.