Liquid staking protocol KelpDAO and its parent entity Evercrest have filed a notice of civil claim in British Columbia against cross-chain messaging protocol LayerZero and its co-founder Bryan Pellegrino over an April breach that resulted in a $292 million loss of rsETH.
Allegations of Unmentioned Infrastructure Vulnerabilities
In a public statement released on X on September 25, KelpDAO alleged that LayerZero failed to disclose critical security weaknesses in its technology or protect its deployment infrastructure. The protocol pushed back against claims that the security failure was solely caused by its own setup, asserting that LayerZero explicitly reviewed and endorsed the deployment and configuration in writing before the incident.
According to estimates from security firm Cyvers, approximately $293.7 million in rsETH was stolen during the breach. The attacker quickly converted the funds into ETH across Ethereum and Arbitrum, leaving several lending protocols—including Aave V3, Compound V3, and Euler—exposed to the market fallout. This legal action follows a previous suit alleging technical failure in the LayerZero integration.
Technical Dispute and Executive Defense
The central point of contention centers on KelpDAO's use of a 1-of-1 Decentralized Verifier Network (DVN) setup. LayerZero argued that relying on a single verifier created an isolated point of failure and claimed it recommended using multiple DVNs. However, KelpDAO referenced its May 6 incident report to argue that the 1-of-1 setup complied directly with LayerZero's official documentation and standard deployment guidelines.
Responding on X, Pellegrino confirmed receiving the notice of civil claim filed in Vancouver and rejected the allegations, stating the claim is meritless and that he will defend himself and his firm in court. Commenting on the legal escalation, Solana Foundation's Seraphim Czecker noted on X that founder dynamics in modern DeFi can turn severe when security incidents result in multi-year legal disputes.
Key Takeaways
- Civil Lawsuit Filed: KelpDAO (Evercrest) filed a claim against LayerZero and CEO Bryan Pellegrino in British Columbia.
- Financial Impact: The April exploit drained $292 million (estimated at $293.7 million by Cyvers) in rsETH.
- Core Controversy: KelpDAO claims LayerZero approved its 1-of-1 DVN configuration in writing, while LayerZero contends the protocol ignored recommendations for multiple verifiers.
- Affected Platforms: Stolen assets moved to ETH across Ethereum and Arbitrum, directly impacting Aave V3, Compound V3, and Euler.
Why It Matters
This legal filing represents one of the most high-profile attempts to shift cross-chain bridge security disputes from informal public debates to commercial courtrooms. If courts determine that core infrastructure developers bear legal liability for how third-party protocols implement their documentation, interoperability providers may be forced to strictly restrict custom deployments or enforce mandatory multi-verifier configurations. The outcome in Vancouver will likely serve as a benchmark for how liability is allocated between protocol builders and cross-chain service providers following major security breaches.
