KelpDAO sues LayerZero over the $292 million bridge hack that gutted Aave

Five months after a forged bridge message drained $292 million in ether, the company behind KelpDAO isn't blaming hackers anymore. It's suing the infrastructure provider that secured the bridge, saying LayerZero signed off in writing on the exact setup it later called the problem.

Evercrest Technologies, the company behind KelpDAO, filed a civil claim in the Supreme Court of British Columbia on September 24 against LayerZero Labs and its co-founder and CEO, Bryan Pellegrino. The claim alleges negligent misrepresentation, negligence, and defamation. It also reopens one of the ugliest DeFi incidents of the year: the April 18 exploit. That drained 116,500 rsETH, roughly $292 million at the time, from Kelp's LayerZero-powered cross-chain bridge. It left Aave holding as much as $230 million in bad debt.

The mechanics of the hack were almost insultingly simple for the size of the loss. Kelp's bridge relied on a 1-of-1 Decentralized Verifier Network configuration, meaning a single verifier could approve a cross-chain message on its own. An attacker forged a message and called lzReceive on LayerZero's EndpointV2 contract. Kelp's bridge contract released 116,500 rsETH with no ETH actually backing it. The wallet that pulled it off had been funded about ten hours earlier through Tornado Cash. Chainalysis later linked the attack to North Korea's Lazarus Group.

Kelp's emergency multisig froze the protocol's core contracts 46 minutes after the drain: fast enough to block two follow-up attempts, but nowhere near fast enough to stop the first one. By then the damage had already moved on. The attacker deposited 89,567 of the freshly minted rsETH on Aave as collateral. Then came roughly $190 million in borrowed wrapped ether, taken while Aave's oracle was still pricing rsETH at its pre-exploit rate. The attacker walked away with real money backed by tokens that didn't exist a day earlier.

An Aave Labs and LlamaRisk incident report published April 20 laid out two scenarios for absorbing the hole. One spreads the loss across all rsETH holders through roughly a 15% haircut on the token's backing ratio, landing at about $123.7 million in bad debt. The other isolates the damage to rsETH on layer-2 networks. That pushes the number to $230.1 million, concentrated on Mantle at a 71.45% WETH shortfall and Arbitrum at 26.67%. Aave froze rsETH across 11 markets within the hour and froze WETH borrowing two days later, but the exposure was already baked in.

The slower bleed turned out to be worse than the hack itself. According to BeInCrypto, Aave's total value locked has fallen from roughly $26 billion before the attack to about $18 billion five months later, a drop of close to a third. Cointelegraph and Forklog both put the outflow north of $8 billion. Depositors pulled funds from Aave's WETH markets even though those markets weren't the ones directly compromised. Fear, it turns out, doesn't check which pool actually took the loss.

Spark, a separate lending protocol, has been a direct beneficiary of that fear. According to CryptoBriefing's reporting on the aftermath, it has absorbed a meaningful share of the capital leaving Aave.

That is the real cost of a bad-debt event in DeFi lending: depositors leave for competitors whether or not those competitors are actually any safer.

The fight over who signed off on what

What makes Evercrest's lawsuit interesting isn't that Kelp got hacked. Protocols get hacked. It's the claim that LayerZero isn't just the company whose infrastructure failed. It's the company that approved the exact configuration it later pointed to as the root cause.

If that holds up, it reframes a technical failure as a vendor relationship gone bad. Every other protocol running a thin verifier setup on someone else's bridge should be paying attention to how this plays out in a Canadian courtroom.

LayerZero hasn't offered a public rebuttal to the specific claims in the filing as of this week. The case is now a matter of civil record in British Columbia. That means depositions and document discovery. Eventually it means a public record of exactly who told whom what, months before either side has to say a word about it in a press release.

Here's the part that should bother anyone still holding funds in cross-chain DeFi: a billion-dollar bridge secured by one verifier was not a secret. It was a configuration choice, made in the open. Nobody flagged it as a dealbreaker until it cost $292 million and triggered an $8 billion run on a protocol that had nothing to do with the bridge itself.

Also read: PayPal raises its outlook even as its stablecoin bet shrinks by a third • Bitwise's Solana ETF hit $1 billion a year after its wild debut • Ethereum developers pull Glamsterdam testnet upgrade over gas bug risk

This article is posted in Crypto News, check it out for more related stories.