KelpDAO has filed a lawsuit against LayerZero and its founder Bryan Pellegrino, claiming the protocol endorsed a specific bridge configuration that ultimately enabled a $292 million exploit of its rsETH liquid staking token. The April 18 incident represents one of the largest single-token drains in DeFi history, and the legal action signals a shift toward holding infrastructure providers accountable for architectural choices that facilitate theft. According to the filing, KelpDAO alleges LayerZero provided written endorsement of the bridge setup in question, suggesting a level of implicit authorization that extends liability beyond mere software provision.
LayerZero has positioned itself as an omnichain messaging protocol rather than a full bridge operator, allowing applications to implement custom validation logic and risk parameters. This architecture inherently distributes responsibility across multiple parties—developers must configure appropriate security measures and select reliable oracles for cross-chain verification. However, the distinction between providing a tool and endorsing a specific deployment becomes legally murkier when written communication suggests approval of a particular configuration. The rsETH exploit itself exploited vulnerabilities in how the bridge was constructed, not necessarily flaws in LayerZero's core protocol, which complicates the liability question but does not necessarily absolve infrastructure providers of duty of care.
This litigation reflects broader tensions emerging in DeFi as losses accumulate and stakeholders seek recourse. Unlike traditional finance, blockchain applications operate across jurisdictions with minimal regulatory clarity, making contract law one of the few available remedies for affected parties. KelpDAO's approach—treating written endorsements as meaningful legal commitments rather than casual technical guidance—could establish precedent for how infrastructure providers must document and distance themselves from deployment decisions made by application developers. If successful, the suit might force protocols like LayerZero to implement stricter disclaimers and reduce the appearance of endorsement when discussing specific configurations.
The outcome will likely influence how other protocols manage their relationship with downstream developers and how much direct involvement they should have in supporting specific applications. As cross-chain infrastructure becomes more critical to DeFi operations, these liability boundaries will increasingly determine whether protocols position themselves as neutral tools or active participants in ecosystem security.