KelpDAO Developer Sues LayerZero Over $292M Bridge Exploit

KelpDAO developer Evercrest has filed a lawsuit against LayerZero, alleging negligence that contributed to a $292 million exploit of the LayerZero bridge. The lawsuit, filed in the Delaware Court of Chancery, claims that LayerZero repeatedly approved a "single-verifier" configuration in writing for the KelpDAO smart contract, despite warnings about its inherent security risks. Evercrest asserts that LayerZero's actions, or lack thereof, directly enabled the exploit that resulted in the loss of approximately $292 million worth of assets, including $196 million in ETH and $96 million in stablecoins. The plaintiff argues that LayerZero's dual-verifier system, designed to enhance security, was bypassed through the approval of the single-verifier setup, which created a single point of failure.

According to the complaint, LayerZero's security team was aware of the risks associated with single-verifier configurations and had previously warned other developers about them. However, Evercrest claims that LayerZero provided written approval for KelpDAO to operate with a single verifier on multiple occasions. This contradictory behavior, the lawsuit contends, demonstrates a pattern of negligence and a failure to uphold its responsibilities in ensuring the security of its bridge protocol. The exploit occurred on March 20, 2024, when attackers exploited a vulnerability in the smart contract, draining the funds that had been deposited into the KelpDAO platform.

Evercrest is seeking damages for the losses incurred by KelpDAO users and is also asking the court to declare LayerZero liable for the exploit. The lawsuit highlights a critical security concern within the decentralized finance (DeFi) ecosystem, where bridge exploits have become increasingly common and costly. The case could set a precedent for the accountability of cross-chain bridge providers in the event of security breaches. LayerZero has not yet filed a formal response to the lawsuit, but the allegations raise significant questions about the security protocols and oversight mechanisms employed by the company. The $292 million figure represents the total value of assets lost at the time of the exploit, making it one of the largest bridge hacks in recent history.

The KelpDAO protocol, built on LayerZero's infrastructure, aimed to provide yield-generating opportunities for users by leveraging various DeFi strategies. The exploit has severely impacted user confidence and the operational capacity of KelpDAO. The lawsuit details a series of communications and agreements between Evercrest and LayerZero, which Evercrest argues demonstrate a clear understanding of the risks involved and a deliberate decision by LayerZero to approve a less secure configuration. The plaintiff's legal team is expected to present evidence of these written approvals and communications to support their claims of negligence and breach of duty by LayerZero.