KelpDAO sues LayerZero after $292 million rsETH exploit: what the lawsuit alleges

On April 18, an attacker drained approximately $292 million from the rsETH (Liquid Restaked Ether) protocol through a vulnerability in how the token moved between blockchains. The exploit did not stem from a simple smart contract bug but rather from how the bridging mechanism was architected: specifically, the setup used to move rsETH across chains relied on LayerZero's infrastructure, a messaging protocol that connects multiple blockchain networks. According to KelpDAO's legal filing, LayerZero representatives, including Bryan Pellegrino, had explicitly endorsed this particular configuration before the exploit occurred.

The timing matters because written endorsement suggests LayerZero's team had reviewed and approved the setup. If true, it creates a question of shared responsibility that goes beyond the typical software-as-a-service liability model most blockchain projects rely on. KelpDAO's argument is that LayerZero did not merely provide a tool but actively validated a risky design choice.

The exploit relied on a flaw in how the bridge verified and processed cross-chain transfers. In multi-chain protocols, bridges must coordinate state across separate networks without a single central validator. LayerZero's model uses a network of relayers and oracles to confirm that a message sent from one chain has reached another. The rsETH implementation appears to have trusted this verification mechanism without sufficient additional safeguards.

An attacker could, in theory, craft a transaction that appeared valid according to the bridge's logic but was designed to extract value from the destination chain. The $292 million figure represents the total liquidity that was accessible through this vulnerability at the moment of exploit. Cross-chain bridge exploits typically target liquidity pools, wrapped token reserves, or staking collateral held in custody during the bridging process.

This is not unique to LayerZero, but the lawsuit specifically claims that LayerZero representatives knew the rsETH configuration was risky and endorsed it anyway. Public statements and written communications will likely become central evidence in the case.

When a software vendor provides infrastructure without explicit approval of how customers use it, liability is typically limited by contract and open-source software licenses. However, if LayerZero did endorse a specific setup in writing, the company may have crossed into territory where it is no longer a neutral tool provider but a participant in the design decision. This shifts the legal framing from "your smart contract failed" to "you encouraged us to build it this way."

Bryan Pellegrino's individual naming in the lawsuit suggests that KelpDAO is arguing a specific person at LayerZero had knowledge of the risks and endorsed the configuration anyway. If LayerZero's internal communications show awareness of potential attack vectors in the rsETH setup, that becomes powerful evidence. The lawsuit may also examine whether LayerZero conducted any security review or made any caveats in its endorsement that KelpDAO did not follow.

This distinction matters because it could expose LayerZero to claims of negligence or misrepresentation, not just contractual disputes. Blockchain infrastructure providers have mostly avoided this kind of liability, but the rsETH case suggests the courts may be willing to examine whether a vendor's specific guidance created a duty of care.

Cross-chain bridges remain one of the highest-value targets for attackers because they hold large amounts of collateral in transit and often use simplified security models compared to single-chain protocols. The rsETH exploit joined a growing list of bridge compromises that have cost the ecosystem billions. Each major bridge exploit has sparked debates about whether bridges should rely on LayerZero, Wormhole, Stargate or home-built solutions.

KelpDAO's lawsuit introduces a new consideration: project teams now have to worry not just about whether a bridge is secure in practice, but whether guidance from the bridge provider was documented and could be used as evidence if something goes wrong. This may create a chilling effect on infrastructure providers offering written opinions about protocol designs, which could paradoxically make it harder for projects to get expert feedback before launch.

Alternatively, it may push providers to be more rigorous about security reviews and to document their due diligence more carefully. If LayerZero's written endorsement lacked caveats or risk warnings, that becomes a problem for the company. If the endorsement included clear disclaimers and acknowledged risks, KelpDAO's case weakens.

The rsETH lawsuit forces an uncomfortable question: who bears responsibility when a bridge setup fails, the project that builds it, the infrastructure provider that powers it, or both. In traditional finance, a bank would be liable for the security of the systems it provides. In blockchain, that responsibility has been deliberately distributed across teams, open-source contributors, and users. KelpDAO's approach assumes that once a provider actively endorses a design, it accepts some share of responsibility for the outcomes.

If the case succeeds, it could establish precedent that infrastructure providers in crypto cannot hide behind vague terms of service if they have explicitly approved a risky configuration. It could also make providers much more cautious about offering opinions, or it could force them to conduct more thorough security reviews before endorsing any setup.

For projects considering using LayerZero or any other cross-chain infrastructure, the lawsuit serves as a reminder to document all interactions with vendors, to get written clarity on which attack vectors the vendor believes are mitigated and which remain the project's responsibility, and to avoid relying on verbal assurances or informal Telegram conversations when security is at stake.

The lawsuit will likely take months or years to resolve, and discovery may reveal internal communications that shape how bridge security is evaluated across the industry. The immediate practical takeaway is that if you are involved in a protocol that relies on cross-chain infrastructure, treat vendor guidance as part of your audit trail and liability analysis, not as a guarantee. Projects should commission independent security audits of bridge implementations and should not rely solely on infrastructure provider assurances.

For ordinary users holding assets that cross chains, the lesson is that bridge exploits often succeed because of architectural decisions made before the protocol launched. Using well-established bridges with long track records and independent security reviews is a basic risk reduction step. If a newer or less-tested bridge offers significantly better rates or features, the cost savings are unlikely to outweigh the potential loss from an exploit.

The rsETH case is ultimately a reminder that responsibility in crypto ecosystems is not clearly defined until something goes wrong. Documenting your interactions with infrastructure providers, asking specific security questions in writing, and avoiding reliance on any single party's assurances can reduce your exposure.

What was the rsETH exploit and when did it happen.

On April 18, an attacker exploited a vulnerability in the rsETH protocol's bridge mechanism to drain approximately $292 million in assets. The exploit targeted how rsETH moved between blockchains using LayerZero's infrastructure.

Why is KelpDAO suing LayerZero over a bridge vulnerability.

KelpDAO alleges that LayerZero representatives, including Bryan Pellegrino, explicitly endorsed the bridge setup that enabled the exploit in writing, which may create shared responsibility beyond typical software licensing agreements.

Does LayerZero endorse all bridge configurations that use its infrastructure.

No. LayerZero provides infrastructure, but not all projects receive formal endorsement from LayerZero staff. The lawsuit specifically claims that rsETH received written approval, which distinguishes it from other uses.

What does this mean for other bridges and cross-chain protocols.

The case may establish precedent that infrastructure providers can face liability if they explicitly approve risky configurations. This could make vendors more cautious about offering guidance or force them to conduct more thorough reviews before endorsing any setup.

Should I avoid bridges that use LayerZero.

The rsETH exploit does not indicate a systemic flaw in LayerZero infrastructure itself, but rather a specific vulnerability in how rsETH was configured. Any bridge carries execution risk; using well-audited bridges with long operational histories reduces but does not eliminate that risk.

Source: The Block