A lawsuit filed by KelpDAO against cross-chain protocol LayerZero alleges that security failures in LayerZero’s infrastructure enabled the theft of roughly $292 million worth of rsETH in an April attack. The complaint, filed Friday, claims LayerZero did not disclose risks in its technology and approved KelpDAO’s bridge configuration in writing before the breach occurred. LayerZero co-founder and CEO Bryan Pellegrino is named as a defendant.

Pellegrino dismissed the allegations as “meritless” and said he would defend the case in Vancouver. The dispute centers on whether the loss resulted from compromised LayerZero nodes, KelpDAO’s bridge setup, or both. LayerZero’s April 18 incident report stated attackers infiltrated internal nodes and manipulated its verifier to approve a forged cross-chain message, allowing the bridge to release stolen rsETH. The report noted the bridge relied on a single LayerZero decentralized verifier network, a configuration the protocol later advised against and ceased supporting.

KelpDAO disputes this account, asserting its DVN configuration had been reviewed and deemed secure by LayerZero prior to the attack. The DAO accused LayerZero of failing to warn of risks and announced plans to migrate its bridge to Chainlink’s Cross-Chain Interoperability Protocol. The lawsuit adds to a months-long standoff over accountability, with KelpDAO seeking to correct the public record and hold LayerZero responsible for the breach’s impact on the broader DeFi ecosystem.

Cointelegraph attempted to obtain comment from LayerZero but received no response before publication. The case underscores ongoing tensions in cross-chain security practices and the challenges of assigning liability in complex blockchain exploits.