KelpDAO Files Lawsuit Against LayerZero Following $292M Bridge Exploit

TLDR

• Restaking platform KelpDAO has initiated legal proceedings against LayerZero and co-founder Bryan Pellegrino following April’s devastating security breach.
• The exploit resulted in the theft of 116,500 rsETH tokens, valued at approximately $292 million during the incident.
• According to KelpDAO’s allegations, LayerZero concealed critical security vulnerabilities and previously validated the bridge configuration as safe.
• CEO Pellegrino has dismissed the legal claim as baseless and pledged to contest it in Vancouver’s judicial system.
• Following the breach, KelpDAO transitioned its rsETH bridge infrastructure to Chainlink’s Cross-Chain Interoperability Protocol.

Restaking protocol KelpDAO has initiated legal action against interoperability platform LayerZero and its co-founder Bryan Pellegrino, stemming from a devastating security breach that extracted hundreds of millions in cryptocurrency from its rsETH bridge during the spring months.

The civil complaint was lodged this week with courts in British Columbia, Canada, identifying both the LayerZero protocol and Pellegrino as defendants.

According to KelpDAO’s allegations, the security compromise occurred due to LayerZero’s failure to reveal critical vulnerabilities within its infrastructure. The protocol further contends that LayerZero neglected to implement adequate safeguards that could have prevented attackers from penetrating its systems.

Details of the Security Breach

On the 22nd of April, malicious actors exploited KelpDAO’s cross-chain infrastructure, which operated using LayerZero’s underlying technology. The bridge controlled nearly twenty percent of all restaked ether in circulation at that moment.

The perpetrators extracted 116,500 rsETH tokens from the platform. The stolen digital assets carried a market value of approximately 292 million dollars during the breach.

Intelligence reports have attributed the assault to hacking collectives operating from North Korea. The majority of the pilfered cryptocurrency was subsequently laundered through various channels, based on previous reporting on this incident.

The ramifications extended well beyond KelpDAO itself. The security breach triggered widespread panic throughout stablecoin ecosystems.

Aave, which operates the most substantial lending protocol in decentralized finance, was forced to secure 300 million dollars in emergency funding. This capital injection became necessary to accommodate mass withdrawal requests from concerned users.

In less than a week following the exploit, decentralized finance platforms collectively hemorrhaged 20 billion dollars in total value locked.

Conflicting Accounts of Liability

Following the security incident, LayerZero released a comprehensive post-mortem analysis. The protocol explained that attackers successfully infiltrated its internal node infrastructure, deceiving its verification mechanism into authenticating a fraudulent cross-chain communication.

LayerZero highlighted that KelpDAO’s bridge architecture depended exclusively on a single LayerZero verifier network for transaction validation. The system lacked a secondary, independent verification layer to cross-check transaction authenticity.

This singular approval mechanism allowed the counterfeit message to pass validation, triggering the unauthorized fund release. LayerZero stated it had previously advocated for multi-verifier configurations and has subsequently discontinued serving as the sole required verifier for partner protocols.

KelpDAO challenges this characterization of events. In May statements, the protocol maintained that its verification architecture had been thoroughly discussed with LayerZero representatives and received explicit security approval beforehand.

KelpDAO contends that LayerZero failed to provide adequate warnings regarding the inherent dangers of the approved configuration.

The formal lawsuit explicitly states that the security compromise “was a direct result of LayerZero’s failures.” KelpDAO additionally alleges that LayerZero conducted reviews and provided written endorsement of its bridge architecture prior to the attack.

Pellegrino issued a swift rebuttal through social media channels. He acknowledged the civil complaint filed in British Columbia targeting both himself personally and LayerZero as an entity.

He characterized the allegations as without merit and announced his intention to mount a vigorous defense in Vancouver’s legal venues.

Cointelegraph contacted LayerZero representatives for official comment but had not obtained a response by press time.

In the aftermath of the breach, KelpDAO reports implementing enhanced security measures to safeguard depositor assets. The protocol has migrated its rsETH bridge operations to Chainlink’s Cross-Chain Interoperability Protocol infrastructure.

KelpDAO states that establishing an accurate public narrative represents one motivation behind the lawsuit, alongside seeking accountability from LayerZero and Pellegrino for the financial damages. The dispute will now proceed through Canadian judicial channels, where opposing parties will present arguments regarding responsibility for one of this year’s most significant decentralized finance losses.

The post KelpDAO Files Lawsuit Against LayerZero Following $292M Bridge Exploit appeared first on Blockonomi.