The origin of the incident: an attacker compromised a LayerZero developer's computer and infiltrated the protocol's infrastructure. With that access, they got the bridge's verifier to approve a transaction that never happened.

The underlying problem: the rsETH bridge operated with a single verifier. There was no second validation capable of catching the fraud.

The result: 116,500 rsETH minted with no real backing. Roughly $292 million.

What makes this case especially relevant is what came after.

LayerZero maintains that KelpDAO chose a high-risk configuration, ignoring its recommendations to use multiple verifiers.

KelpDAO offers a different account: it claims LayerZero reviewed and approved that exact configuration in writing before the attack, without warning of the risk it carried.

The underlying question is simple, but not trivial:

If an infrastructure provider formally approves a configuration, can it later shift full responsibility to the client that implemented it following that approval?

A few data points that help size up the case:

→ The attack contributed to a liquidity crisis that wiped out $20 billion in DeFi deposits
→ KelpDAO says it paused the bridge in roughly an hour, preventing a second attempted theft of $95-100 million
→ Following the incident, LayerZero eliminated single-verifier configurations in favor of multi-verifier schemes

Bryan Pellegrino, CEO of LayerZero, has called the lawsuit meritless and confirmed he will defend the case before the Vancouver court.

Regardless of the judicial outcome, the case raises a question that goes beyond these two protocols:

When we build on third-party infrastructure, where does the provider's responsibility end and the client's begin?