KelpDAO Sues LayerZero and Its Co-Founder Over the $292 Million rsETH Bridge Exploit

KelpDAO, the operator of the restaking token rsETH, sued LayerZero and its co-founder Bryan Pellegrino over the April 18 exploit that drained 116,500 rsETH, worth roughly $292 million at the time. The complaint alleges negligent misrepresentation, negligence and defamation, and claims LayerZero failed to disclose weaknesses in its own messaging setup while reviewing and endorsing the configuration Kelp used.

The attack path was not a contract bug. According to reporting on the filing, an attacker used social engineering in early March to install malware on a LayerZero developer's machine, then tampered with LayerZero remote procedure call nodes and hit an outside provider with a denial-of-service attack, so that LayerZero's decentralized verifier network approved a forged message. The verifier signed what it was shown. Kelp's argument is that LayerZero knew a single-verifier configuration could be defeated that way and approved it anyway.

Pellegrino has called the lawsuit meritless and said he will defend himself and the company in a British Columbia court. Cointelegraph reported the filing as an allegation that LayerZero's security failures caused the exploit. Kelp says users have withdrawn more than $650 million since April and that it committed 2,000 ETH toward restoring rsETH's backing.

Both sides have an obvious interest. Kelp needs to shift the loss and repair its reputation with depositors. LayerZero needs to preserve the claim that its verifier design is sound and that integrators choose their own configurations. The case will test whether an interoperability provider that reviews a client's setup carries legal duty when that setup fails.