KelpDAO Sues LayerZero Over $292 Million Stablecoin Exploit

KelpDAO, the company behind the stablecoin sbUSD, has filed a lawsuit against LayerZero Labs, alleging that the latter's security infrastructure was compromised and led to a $292 million exploit on April 18. The attack, which occurred at approximately 17:35 UTC, targeted the Unichain bridge and resulted in the theft of 116,500 rsETH.

The notice of civil claim filed by KelpDAO's parent company, Evercrest Technologies, alleges that LayerZero reviewed and endorsed the 1-of-1 decentralized verifier network (DVN) configuration used by the Unichain bridge. This configuration was later found to be vulnerable to exploitation.

KelpDAO claims that LayerZero had warned another developer, USDT0, about the risks associated with default DVN configurations but failed to do so for KelpDAO's setup. The lawsuit also takes issue with LayerZero's public response following the attack, which KelpDAO argues was misleading and defamatory.

As a result of the exploit, KelpDAO has begun migrating rsETH to an alternative cross-chain security standard and has sunset its sbUSD product. The company is seeking damages for negligent misrepresentation, negligence, and defamation, as well as aggravated and punitive damages.