KelpDAO sued LayerZero and its co-founder Bryan Pellegrino, alleging that undisclosed flaws in the cross-chain protocol enabled the largest decentralized finance exploit of the year. The claim was posted on X on Thursday and states that the exploit was a direct result of LayerZero’s failures to disclose risks and to prevent infiltration of its security infrastructure.
Lawsuit allegations
KelpDAO, a decentralized liquid staking protocol on Ethereum, says LayerZero’s universal bridge allowed attackers to steal 116,500 rsETH, valued at about $292 million. The lawsuit, filed as a notice of civil claim in British Columbia, names both LayerZero and Pellegrino as defendants. KelpDAO argues that the bridge’s alleged weaknesses were not made public, which left users exposed.
Exploit details
On April 22, a group linked to North Korea allegedly targeted KelpDAO’s cross-chain bridge. At the time the bridge held nearly a fifth of the rsETH circulating supply. The drain of 116,500 rsETH prompted Aave, the largest DeFi lending pool, to borrow $300 million to meet rising withdrawal requests. Days after the attack, the incident erased roughly $20 billion from total value locked across DeFi platforms, a figure cited by analysts including those at JPMorgan.
Market repercussions
The exploit contributed to a broader liquidity crisis, shaking confidence in cross-chain bridges and prompting KelpDAO to migrate rsETH’s bridge to a more secure standard. The protocol said it has taken steps to protect user assets but insists that LayerZero must be held accountable for the harm caused to the wider ecosystem.
Why it matters
The case highlights ongoing security challenges in cross-chain technology and the potential for large-scale losses when vulnerabilities are not disclosed. It also underscores how a single exploit can reverberate through lending markets and trigger significant outflows from decentralized finance, raising questions about risk management and transparency in the sector.
