$292M Theft Lawsuit Exposes LayerZero's Bridge Configuration Approval and Risk Warnings

A lawsuit filed by KelpDAO against LayerZero highlights approval of the configuration used by the attacked bridge and an alleged risk warning to another project, USDT0.

According to the complaint, Evercrest Technologies, the company behind KelpDAO, alleges that LayerZero warned USDT0 about security measures it had not recommended to KelpDAO. This is among the details in the lawsuit over the theft of 116,500 rsETH worth approximately $292 million on April 18.

Evercrest alleges that in correspondence dated February 2, 2024, LayerZero said there was no issue with using the default verifier network configuration, citing a 1-of-1 configuration used on another bridge on March 21, 2024. In this setup, verification by a single verifier network is enough to approve bridge messages.

The plaintiff argues that LayerZero did not warn KelpDAO about the risks of relying on its own verifier network and did not recommend using multiple verifier networks. By contrast, the complaint alleges that USDT0 was warned about the risks of the default configuration before the attack.