KelpDAO Developer Claims LayerZero Gave Conflicting Security Guidance Before $292M Bridge Exploit

The KelpDAO developer behind Evercrest is taking legal action against LayerZero, alleging the cross-chain protocol bears responsibility for a $292 million bridge exploit. The core allegation: LayerZero approved a risky single-verifier configuration in writing on multiple occasions, then contradicted itself by warning another developer about that exact same setup.

This lawsuit signals escalating tension in the cross-chain crypto ecosystem around security practices and liability when exploits occur. We're tracking this closely because it touches on fundamental questions about who owns the risk when infrastructure providers make conflicting recommendations.

The Single-Verifier Problem

According to Evercrest's legal filing, LayerZero explicitly approved a single-verifier configuration in written communications. This setup—routing all transaction verification through one entity—is universally recognized as a critical security vulnerability in the bridge architecture world. It's the kind of centralization point that makes security auditors lose sleep.

Here's where it gets messy: LayerZero allegedly warned another developer about the dangers of this exact configuration, suggesting they knew the risks all along. If LayerZero was aware enough to caution someone else, the lawsuit implies, they should have been equally forthright with the KelpDAO team.

Timeline and Stakes

The $292 million loss makes this one of the largest bridge exploits in recent crypto history. Bridge hacks remain a persistent vulnerability across the industry—we've covered dozens—but the size here combined with the documentation allegations gives this case real teeth. The lawsuit essentially argues that LayerZero's inconsistent security guidance directly enabled the attack.

The implications extend beyond this single incident. If a court determines that infrastructure providers can be held liable for security recommendations they gave in writing, it fundamentally changes how protocols interact with developers building on top of them.

What This Means for the Ecosystem

This case sits at the intersection of three crypto realities: (1) bridge security remains technically immature, (2) multiple parties often bear partial responsibility when exploits succeed, and (3) written communications can create legal liability.

For builders considering LayerZero or competing cross-chain solutions, the takeaway is brutal: get everything in writing, document all security advice exchanges, and never rely on verbal assurances. The litigation risk is real now.

LayerZero hasn't publicly commented on the specific allegations yet, but expects they'll argue that developers bear ultimate responsibility for their own security architecture decisions—a standard defense in crypto incidents. They'll likely emphasize that approving a configuration isn't the same as recommending it, and that developers have fiduciary duties to conduct independent security audits.

The crypto market intelligence here is straightforward: bridge protocols face mounting legal exposure. This could accelerate industry consolidation toward more established players with deeper legal resources, while smaller cross-chain solutions face higher insurance and compliance costs.