KelpDAO Sues LayerZero Over $292M rsETH Exploit

KelpDAO has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino over a $292 million rsETH exploit in April. The attack resulted in the theft of 116,500 rsETH, which KelpDAO claims was due to LayerZero's failure to disclose vulnerabilities and secure its infrastructure.

According to the lawsuit, LayerZero did not provide key warnings about potential risks and failed to protect against attackers exploiting its verification system during the incident. Pellegrino has dismissed the lawsuit as 'frivolous' and vowed to fight it out in court.

The $292 million exploit occurred when an attacker social engineered their way into the hands of a LayerZero developer, then infiltrated the company's RPC system. The attackers used defrauded data on the blockchain to obtain a valid attestation from LayerZero's verification system, leading to the release of rsETH without token burn in the source chain.

LayerZero has pointed to KelpDAO's use of a 1-of-1 Decentralized Verifier Network (DVN) setup as a contributing factor to the exploit. However, KelpDAO disputes this assertion, claiming that it was approved by LayerZero in writing and deployed as recommended.