New Details in $292 Million Attack Lawsuit: Claim That Another Project Was Warned of Risks
A lawsuit filed by KelpDAO against LayerZero highlights approval of the configuration used by the attacked bridge and an alleged risk warning to another project.
According to the complaint reported by The Block, Evercrest Technologies, the company behind KelpDAO, alleges that LayerZero warned USDT0 about security measures it had not recommended to KelpDAO. The allegation is among the details in the lawsuit over the theft of 116,500 rsETH worth approximately $292 million on April 18.
Claim of Approval for KelpDAO, Risk Warning to USDT0
Evercrest alleges that in correspondence dated February 2, 2024, LayerZero said there was no issue with using the default verifier network configuration. According to the complaint, the company also cited a 1-of-1 configuration used on another bridge on March 21, 2024. In this setup, verification by a single verifier network is enough to approve bridge messages.
The plaintiff argues that LayerZero did not warn it about the risks of relying on its own verifier network and did not recommend using multiple verifier networks. By contrast, the complaint alleges that USDT0 was warned about the risks of the default configuration before the attack. The documents cited do not specify when this warning was issued.
Dispute Over Responsibility After the Attack
Evercrest also disputes LayerZero’s post-attack claim that KelpDAO’s setup did not comply with the recommended multi-verifier model. The company argues that this public statement contradicts the guidance it had previously received.
The complaint filed in the Supreme Court of British Columbia includes claims of negligence, negligent misrepresentation, and defamation against LayerZero companies and co-founder Bryan Pellegrino. Pellegrino, meanwhile, called the allegations baseless and said he would defend himself. The account of the risk warning and responsibility is based on the plaintiff’s allegations.
Evercrest also says that users have withdrawn more than $650 million in assets from KelpDAO since the attack. This amount refers to user withdrawals afterward, not the amount stolen in the attack. The company also says it has discontinued its sbUSD product and begun moving rsETH to an alternative cross-chain security standard.