{"id":13753,"date":"2026-09-26T14:01:58","date_gmt":"2026-09-26T14:01:58","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13753"},"modified":"2026-09-26T14:01:58","modified_gmt":"2026-09-26T14:01:58","slug":"nearly-15b-is-moving-off-layerzero-now-a-292m-lawsuit-puts-its-security-model-on-trial","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13753","title":{"rendered":"Nearly $15B is moving off LayerZero, now a $292M lawsuit puts its security model on trial"},"content":{"rendered":"

<\/p>\n

\n

Evercrest Technologies, the company behind KelpDAO, has sued LayerZero Labs, its Canadian affiliate, and CEO Bryan Pellegrino in British Columbia over April’s $292 million rsETH exploit.<\/p>\n

The claim alleges negligent misrepresentation, negligence and defamation, seeks aggravated and punitive damages, and says Kelp users have withdrawn more than $650 million since the attack.<\/p>\n

Pellegrino has called the suit meritless. By Aug. 4, projects tied to roughly $14.5 billion in assets had announced moves from LayerZero to Chainlink’s CCIP, nearly 50 times the amount stolen.<\/p>\n

The lawsuit now asks a court to settle a responsibility dispute that customers have been pricing on their own since April.<\/p>\n

Two failures had to line up<\/h2>\n

On April 18, attackers tricked LayerZero’s verifier into approving a forged cross-chain transfer. LayerZero’s incident report traces the intrusion to a developer who was socially engineered into cloning a malicious GitHub repository in March.<\/p>\n

The attackers reached LayerZero’s RPC environment, poisoned two internal nodes, and knocked an external RPC provider offline, so the verifier signed a message built on false source-chain data and 116,500 rsETH left Kelp’s bridge.<\/p>\n

That compromise succeeded because Kelp’s bridge required approval from a single verifier, LayerZero’s own, leaving one party able to authorize the release. The on-chain signature check worked as designed, since the signature was valid and simply attested to false information.<\/p>\n

LayerZero’s report splits the blame accordingly, assigning the number of required verifiers to the application and the compromised RPC layer to LayerZero as its operator.<\/p>\n\n\n\n\n\n\n\n\n\n
Security layer<\/th>\nWhat was supposed to happen<\/th>\nWhat failed<\/th>\nWho controlled that layer<\/th>\n<\/tr>\n<\/thead>\n
Verifier count<\/strong><\/td>\nMultiple independent verifiers could reject a bad message<\/td>\nKelp required only LayerZero’s verifier<\/td>\nApplication \/ Kelp<\/td>\n<\/tr>\n
RPC data<\/strong><\/td>\nVerifier receives accurate source-chain state<\/td>\nAttackers poisoned LayerZero-operated RPC infrastructure<\/td>\nLayerZero<\/td>\n<\/tr>\n
Independent check<\/strong><\/td>\nA second verifier could disagree with false data<\/td>\nNo second required verifier existed<\/td>\nApplication configuration<\/td>\n<\/tr>\n
Signature generation<\/strong><\/td>\nVerifier signs only valid source-chain events<\/td>\nLayerZero’s verifier signed false data<\/td>\nLayerZero-operated verifier<\/td>\n<\/tr>\n
On-chain contract<\/strong><\/td>\nAccept valid signatures from configured verifier set<\/td>\nWorked exactly as configured<\/td>\nSmart contract logic<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Kelp’s claim targets what happened to LayerZero before the hack<\/h2>\n

Evercrest alleges LayerZero reviewed and approved the single-verifier setup in writing, including telling Kelp in February 2024 there was \u201cno problem\u201d with a default configuration.<\/p>\n

The suit also alleges LayerZero warned another developer, USDT0, about risks in default verifier configurations while withholding a comparable warning from Kelp.<\/p>\n

Those allegations have yet to be tested in court. LayerZero’s account puts the choice on Kelp, saying the application had previously used a two-of-two configuration and moved to one-of-one.<\/p>\n

LayerZero’s verifier now refuses to sign on any channel where it’s the only required signer, and the company requires multiple independent RPC sources across providers and geographies.<\/p>\n

By Aug. 4, it had moved default pathways on both versions of its endpoint to a minimum of three verifiers, while applications can still build custom setups at the protocol level.<\/p>\n

LayerZero also said in May that letting its own verifier act alone on high-value transfers had been a mistake, and it maintained the incident touched about 0.14% of the applications on its network.<\/p>\n

LayerZero customers moved faster than the courts<\/h2>\n

BitGo accounted for the largest migration, with WBTC making up about $7.4 billion of the Aug. 4 tally, and it named CCIP its exclusive cross-chain provider for WBTC and the default for future BitGo-issued assets.<\/p>\n

Mantle, Kelp’s rsETH and Lombard added billions more, and Chainlink puts the total near $15 billion. Kelp says its own migration remains underway, so announced value and completed transfers are separate measures.<\/p>\n