KelpDAO Sues LayerZero Over $292M DeFi Exploit
Legal battle erupts over cross-chain security failure and infrastructure vulnerabilities.
1$292M cross-chain exploit
In April 2026, attackers stole 116,500 rsETH (worth $292M) from KelpDAO's LayerZero bridge. The breach occurred through social engineering targeting a LayerZero developer, compromising their RPC system. This allowed forged blockchain data to reach LayerZero's verification system, enabling unauthorized cross-chain transfers without corresponding token burns on the source chain. Chainalysis confirmed the attack didn't exploit KelpDAO's smart contracts directly.
2Single-point failure in verification
The rsETH bridge used a 1-of-1 Decentralized Verifier Network (DVN) with LayerZero Labs as sole verifier. This architecture created a critical vulnerability - when the single verifier was compromised, there were no independent validators to reject fraudulent messages. LayerZero claims it had recommended multi-DVN redundancy, while KelpDAO insists LayerZero approved the 1-of-1 configuration in writing, a key dispute in the lawsuit.
3Legal battle escalates
KelpDAO filed suit on September 25, 2026 against LayerZero and CEO Bryan Pellegrino, alleging failure to disclose vulnerabilities and secure infrastructure. LayerZero dismisses the claims as frivolous, vowing to fight in Vancouver courts. The case will examine responsibility for bridge configuration, security warnings, and infrastructure protection prior to the $292M exploit.
4Post-attack security shifts
Following the exploit, KelpDAO migrated its rsETH bridge from LayerZero to Chainlink's CCIP for cross-chain security. LayerZero responded by dropping 1-of-1 DVN support for compromised apps and strengthening related infrastructure. These technical changes now face judicial scrutiny regarding whether they could have prevented the initial attack.
5Industry-wide implications
The lawsuit represents the first major legal test for cross-chain security providers' liability. Its outcome could establish precedent for responsibility allocation between protocol developers and infrastructure providers in DeFi exploits. The case also highlights ongoing tensions in balancing decentralization with security in cross-chain bridges.
6Social engineering vector
The attack began with social engineering targeting a LayerZero developer, demonstrating how human factors remain critical vulnerabilities in decentralized systems. The compromised developer access allowed attackers to hijack RPC infrastructure, feeding false data to the verification system. This bypassed technical safeguards through personnel exploitation.
7Verification system flaws
LayerZero's investigation revealed the attack exploited the verification system's inability to detect malformed cross-chain messages when receiving fraudulent RPC data. The valid attestation of forged messages enabled the rsETH release. This exposed fundamental gaps in cross-chain message validation processes under compromised infrastructure conditions.
8Security accountability debate
The case centers on whether infrastructure providers bear responsibility for third-party implementations using their technology. KelpDAO alleges LayerZero failed to properly secure or warn about its verification system, while LayerZero maintains KelpDAO chose risky configurations. The verdict could redefine security expectations in DeFi's shared infrastructure ecosystem.
Original article: CryptoNinjas — KelpDAO Sues LayerZero Over $292M DeFi Exploit