LayerZero Sued Over $292M rsETH Bridge Exploit

KelpDAO developer Evercrest Technologies has filed a lawsuit against LayerZero Labs and its CEO Bryan Pellegrino over a $292 million exploit of the protocol's rsETH bridge. The incident occurred on April 18, with the company claiming that an attacker compromised a LayerZero developer's machine on March 6 before targeting the RPC infrastructure used by LayerZero's Decentralized Verifier Network.

The manipulated RPCs allegedly caused LayerZero's DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place. With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation resulted in the minting of $292 million in rsETH on Ethereum.

KelpDAO claims it identified the attack within an hour and took swift action to prevent further losses, suspending its LayerZero bridges, freezing the attacker's wallet, and stopping a second attempted mint of 40,000 rsETH. However, LayerZero later blamed KelpDAO's single-verifier configuration for the incident.

KelpDAO disputes this account, citing written instructions from LayerZero to use its own DVN in a 1-of-1 setup. The company is seeking damages for various losses, including a 2,000 ETH recapitalization and lost fee revenue.