Layerzero Faces $292M Lawsuit Over Bridge Exploit

On April 18th, attackers exploited KelpDAO's Layerzero-powered bridge, releasing 116,500 rsETH worth approximately $292 million without a matching burn. The money moved in one block.

KelpDAO filed a civil claim against Layerzero Labs and its CEO Bryan Pellegrino on September 24th, accusing the company of failing to disclose technological risks and prevent attackers from compromising infrastructure used by its verifier.

Layerzero has acknowledged that its RPC environment was compromised but points to Kelp's 1-of-1 verifier configuration as the single point of failure. The company had recommended configurations using multiple verifiers, but Kelp's setup was documented as Layerzero's default.