When your bridge collapses, you can blame the architects or the inspectors, but this lawsuit says LayerZero was both.

The Summary

The Signal

The April 18 attack on Kelp DAO's rsETH bridge was surgically precise. Attackers exploited a single-verifier configuration to drain $292 million. Standard bridge architecture uses multiple independent validators to confirm cross-chain transactions. A single verifier is like having one person count all the votes, then trusting their word. It worked until it catastrophically didn't.

Kelp's lawsuit alleges LayerZero endorsed this exact setup in writing before the attack. If true, that's not a miscommunication or a technical oversight. That's documented approval of a security model that LayerZero later publicly blamed Kelp for using. The whiplash is the story here.

"LayerZero approved the single-verifier setup attackers used in April, then blamed Kelp for it."

After the exploit, the finger-pointing started immediately. LayerZero's public statements implied Kelp had misconfigured their bridge. But Kelp's legal filing claims they have written endorsement from LayerZero for the very architecture that failed. If LayerZero knew the single-verifier model was fragile, why approve it? If they didn't know, what does that say about their security review process?

Pellegrino's response was swift and dismissive, calling the lawsuit meritless. That's either confidence in LayerZero's documentation trail or a bet that Kelp can't prove written endorsement in court. Either way, discovery is going to be brutal. Email chains, Slack logs, technical review documents. Everything that shows who knew what and when.

Key legal and technical questions this case surfaces:

  • What level of security review does a bridge provider owe to protocols integrating their infrastructure?
  • If LayerZero documented approval of the setup, does that create liability even if Kelp implemented it?
  • Can bridge providers publicly blame integrators for exploits if they previously approved the architecture?

This isn't just about $292 million. It's the biggest exploit of 2026, and the case will set precedent for how blame and liability get assigned when cross-chain infrastructure fails. Every protocol using LayerZero or any other bridge is watching to see if written approvals from infrastructure providers actually mean anything, or if they're just liability theater.

The cross-chain bridge business has always been built on trust assumptions. You trust the validators. You trust the smart contracts. You trust the team that designed the security model. When $292 million evaporates, those trust assumptions get tested in court. This lawsuit is asking: if LayerZero signed off on Kelp's setup, can they later claim it was Kelp's fault when attackers exploited exactly what LayerZero approved?

The Implication

If you're building on any cross-chain infrastructure, get every security decision in writing. Not just "this should work" on a call. Written technical review. Written approval. Written acknowledgment of trade-offs. Because when the exploit happens, and it always eventually happens, the only thing that matters is what you can prove you were told versus what you actually did.

For bridge providers, this case is a warning shot. If you approve a security model, even informally, you might own the consequences. That changes the incentive structure. Do you document everything and potentially create liability, or stay vague and preserve deniability? The answer will shape how honest cross-chain security conversations can actually be.

Sources

Unchained Crypto | The Block | CoinDesk | CoinTelegraph | BeInCrypto