Nearly $15B is moving off LayerZero, now a $292M lawsuit puts its security model on trial
Evercrest Technologies, KelpDAO’s parent, sued LayerZero Labs, its Canadian affiliate and CEO Bryan Pellegrino in British Columbia over April’s $292 million rsETH exploit. It alleges negligence, negligent misrepresentation and defamation, claiming LayerZero approved Kelp’s single-verifier setup and failed to warn it of risks. LayerZero says Kelp chose to move from two verifiers to one and calls the suit meritless. The attack exploited compromised RPC infrastructure, allowing LayerZero’s verifier to approve a forged transfer. LayerZero has since tightened defaults and requires multiple verifiers and independent RPC sources. The breach has prompted projects associated with roughly $14.5 billion in assets to announce migrations to Chainlink CCIP, including BitGo and Wyoming’s state stable-token commission. The court will consider how responsibility should be divided between the application choosing its security configuration and the provider operating the compromised infrastructure.
