KelpDAO lawsuit accuses LayerZero of failing to secure $292M rsETH bridge exploit

KelpDAO has filed a lawsuit against LayerZero, alleging that the cross-chain protocol’s security failures enabled a $292 million exploit of its rsETH bridge in April. The lawsuit, filed this week, accuses LayerZero of failing to disclose risks in its infrastructure and of approving a flawed deployment that allowed an attacker to compromise the bridge by forging a cross-chain message. According to KelpDAO, the breach occurred because the protocol relied on a single decentralized verifier network (DVN) for validation, a configuration that LayerZero had previously recommended against and subsequently abandoned as the sole required verifier for applications. The exploit resulted in the theft of 116,500 rsETH tokens, worth approximately $292 million at the time of the attack.