LayerZero (Bridge Protocol Liability)

1 February 2021

LayerZero Labs founded by Bryan Pellegrino, Ryan Zarick, and Caleb Banister in Vancouver, British Columbia.

30 January 2023

James Prestwich (Nomad bridge founder) alleged LayerZero's Endpoint and UltraLightNodeV2 contracts contained an undisclosed 'backdoor' permitting the LayerZero MultiSig to pass arbitrary messages. LayerZero CEO Bryan Pellegrino acknowledged the capability but denied it was hidden. No regulatory action followed.

28 March 2024

LayerZero silently updated the MPTValidator verification contract to MPTValidatorV2, patching a critical vulnerability discovered by Cobo Security Team that allowed a malicious relayer to forge cross-chain messages via manipulated MPT proof data. No public disclosure was made at the time.

20 June 2024

ZRO governance token launched to approximately 1.28 million eligible wallets via a 'Proof of Donation' mechanism requiring 10 cents per token. Over 803,000 addresses were excluded as sybils. ZRO fell approximately 24% within 24 hours amid community backlash over the pay-to-claim structure.

18 April 2026

KelpDAO's rsETH cross-chain bridge, built on LayerZero V2 with a 1-of-1 DVN configuration, was exploited for approximately $292 million (116,500 rsETH). Attackers, preliminarily attributed by LayerZero to the Lazarus Group's TraderTraitor subunit, compromised two RPC nodes used by LayerZero's own DVN. A simultaneous DDoS forced failover to the compromised nodes, enabling fraudulent message validation and unbacked rsETH minting.

20 April 2026

LayerZero published its post-mortem attributing the KelpDAO exploit to North Korea's Lazarus Group (TraderTraitor subunit) with 'preliminary confidence,' while placing primary responsibility on KelpDAO's 1-of-1 DVN configuration choice.

5 May 2026

KelpDAO publicly claimed that LayerZero had reviewed and endorsed in writing the 1-of-1 verifier configuration that LayerZero's post-mortem blamed for the exploit.

9 May 2026

LayerZero issued a public apology, reversing its initial stance by admitting it should not have permitted its DVN to act as a sole verifier for high-value transactions. LayerZero announced a ban on 1-of-1 DVN configurations and migration to multi-verifier defaults.

15 July 2026

PeckShield alleged that LayerZero Core Executor wallets were drained of $2.4 million across eight chains. LayerZero Labs clarified on the same day that the transfers were routine internal fund rebalancing, not an exploit. No user funds were lost.

25 September 2026

Evercrest Technologies (KelpDAO developer) filed a notice of civil claim in the Supreme Court of British Columbia against LayerZero Labs and CEO Bryan Pellegrino personally, seeking damages related to the $292 million rsETH exploit. The lawsuit was pending with no court ruling on the merits as of October 2026.