KelpDAO Sues LayerZero Over $292M Hack and Biggest DeFi Loss

KelpDAO, a liquid staking protocol on Ethereum, has filed a civil lawsuit in British Columbia against LayerZero and its co-founder Brian Pellegrino, accusing them of concealing vulnerabilities that enabled what's being called the biggest heist of the year, valued at $292 million. According to the statement published on X, the financial damage adds to the shockwave that has rippled through the entire DeFi ecosystem, resulting in $20 billion in lost value (TVL). (CoinDesk)

KelpDAO Accuses LayerZero of $292M Breach

The lawsuit centers on the claim that LayerZero failed to disclose the weaknesses and inherent risks in its universal protocol, allowing attackers to exploit them. "The exploit is a direct result of LayerZero's shortcomings, including its failure to disclose vulnerabilities and inherent risks in its technology," KelpDAO stated. The complaint alleges that omitting this information constitutes gross negligence, especially considering LayerZero's central role in cross-chain bridges. (CoinDesk)

Furthermore, KelpDAO argues that LayerZero failed to prevent intrusions into its security infrastructure, allowing hackers to exploit the supposedly weaknesses in its universal bridge. The protocol claims it has never sought to shirk its responsibilities, but rather strengthened asset protection post-incident. This stance reinforces the logic of the lawsuit, which seeks compensation and compels LayerZero to assume full responsibility for the damage caused. (CoinDesk)

The April 22 Hack Drained 116,500 rsETH

On April 22, a group of North Korean hackers allegedly targeted KelpDAO's cross-chain bridge, siphoning 116,500 rsETH, equivalent to approximately $292 million at the time of attack. This loss represented nearly one-fifth of the circulating supply of the staked token, underscoring the severity of the technical flaw. The theft immediately triggered a panic among holders, who rushed to withdraw their positions, amplifying liquidity pressure on the protocol. (CoinDesk)

The rsETH drain had immediate repercussions on other DeFi platforms, including Aave, which had to borrow $300 million to address a massive wave of withdrawals. This cascading effect highlighted the fragility of the shared liquidity model, where the loss of a major bridge can quickly spread across the entire system. Analysts from JPMorgan, cited in the report, emphasized that this incident exposes lingering structural risks in the sector. (CoinDesk)

Immediate Consequences: $20B TVL Liquidity Crisis

Within days, the exploit wiped out roughly $20 billion in total value locked (TVL) across decentralized finance, marking the steepest drop in years. This TVL contraction impacted not only lending protocols but also exchanges and yield funds, which saw their assets under management plummet spectacularly. On-chain data showed massive capital outflows, confirming investor distrust, both institutional and retail. (CoinDesk)

The liquidity crunch also triggered a wave of forced liquidations, exacerbating the volatility of prices for assets tied to the affected protocols. Market observers noted that stablecoins faced selling pressure, worsening the overall liquidity situation. This dynamic underscored the vulnerabilities of the high-yield model, where a single point of failure can lead to systemic collapse. (CoinDesk)

Reactions from LayerZero and Its Co-Founder

Brian Pellegrino immediately dismissed the allegations, calling the lawsuit "baseless." "Evercrest (KelpDAO) filed today a civil claim in British Columbia against me and LayerZero," Pellegrino said, adding: "The claim remains baseless. I will meet them in Vancouver and defend myself accordingly." He noted that the defense would take place before British Columbia courts, emphasizing the intention to vigorously contest the allegations. (CoinDesk)

LayerZero, for its part, reminded that security incidents often involve external factors and that the protocol has consistently improved its protection mechanisms. The company stated it is ready to cooperate with authorities while insisting that the vulnerabilities cited by KelpDAO were not known at the time of the bridge deployment. This position aims to limit legal responsibilities while preserving the network's reputation among cross-chain developers. (CoinDesk)

Analysis of Universal Protocol Weaknesses

According to KelpDAO, the undisclosed vulnerabilities primarily concerned cross-chain message validation and cryptographic signature management, two critical components of the LayerZero bridge. The absence of robust safeguarding mechanisms allowed hackers to counterfeit transactions and divert funds without triggering any alerts. This critique highlights the ongoing challenge of balancing interoperability with security in decentralized architectures. (CoinDesk)

Cybersecurity experts pointed out that cross-chain bridges are among the most lucrative targets due to their role as gateways between different blockchains. The lack of transparency regarding audits and penetration tests makes it difficult to assess risk levels for users. KelpDAO has therefore called on LayerZero to publish a comprehensive report on the exploited vulnerabilities, aiming to restore market confidence. (CoinDesk)

Prospects for DeFi Sector Stability

In response to the incident, KelpDAO migrated its rsETH bridge to a cross-chain security standard deemed more resilient, asserting that users' assets are now protected. This move seeks to limit future losses and demonstrate the protocol's ability to quickly adapt to threats. The action has been favorably received by part of the community, which sees it as a strong signal of responsibility. (CoinDesk)

Analysts from JPMorgan, cited in the report, emphasized that the exploit underscores the need for stricter governance and independent audits for cross-chain bridges. They predict that regulators could intensify their oversight, imposing stricter disclosure requirements. For sector players, the challenge will be to balance rapid innovation with heightened security demands to avoid new exploits repeating the $292 million loss scenario. (CoinDesk)