KelpDAO sues LayerZero over $292M bridge exploit

TLDR

KelpDAO has filed a civil lawsuit against cross-chain provider LayerZero, arguing its bridge design and security failures enabled a $292 million exploit of Kelp's rsETH restaking token.

1. Evercrest Technologies, KelpDAOs operator, is suing LayerZero and CEO Bryan Pellegrino in British Columbia, alleging negligence, misrepresentation, and defamation over the April rsETH bridge exploit.
2. The exploit drained about 116,500 rsETH worth roughly $292 million after attackers compromised LayerZero infrastructure and abused a single-verifier bridge setup, triggering major DeFi contagion.
3. The case could set an important precedent on whether infrastructure providers are liable for client bridge losses, while restaking and cross-chain designs are already shifting toward multi-verifier models.

Deep Dive

1. Lawsuit And Allegations

Evercrest Technologies, the company behind KelpDAO, has filed a civil claim in the Supreme Court of British Columbia against LayerZero Labs entities and co-founder Bryan Pellegrino, seeking aggravated and punitive damages for an exploit that stole about $292 million from Kelps restaking protocol.Evercrest Technologies filed a civil claim over the incident.

The suit alleges negligent misrepresentation, negligence, and defamation. Evercrest claims LayerZero explicitly reviewed and endorsed Kelps one-of-one bridge configuration, where LayerZeros verifier network was the only party confirming cross-chain messages, and failed to disclose associated risks.Evercrest alleges LayerZero endorsed the 1-of-1 DVN setup.

Defamation claims focus on incident statements and social posts where LayerZero and Pellegrino publicly blamed Kelp for the configuration. Pellegrino has rejected the claim, calling it meritless and saying he will defend himself in Vancouver.Pellegrino called the lawsuit meritless. The allegations have not yet been tested in court.

2. Exploit Mechanics And Impact

On April 18, attackers drained around 116,500 rsETH, KelpDAOs liquid restaking token, via a LayerZero-powered bridge, releasing unbacked assets on Ethereum after a forged message claimed a burn on another chain.The bridge released 116,500 rsETH worth $292 million.

Security investigations describe a social-engineering attack on a LayerZero developer, malware on internal machines, compromise of RPC infrastructure, and a denial-of-service push that forced verification through poisoned nodes.LayerZeros incident report details compromised nodes and forged messages. LayerZero and several firms tie the attackers to TraderTraitor, a Lazarus Group subunit.

Because Kelps bridge used a single decentralized verifier network, one compromised verifier was enough to approve the fraudulent packet. The fallout was severe. Aave faced an estimated 123.7 million to 230.1 million dollars in bad debt, and DeFi total value locked dropped by tens of billions.DeFi TVL fell sharply after the rsETH exploit. Kelp has since migrated rsETH bridging from LayerZeros OFT to Chainlink CCIP.

3. What To Watch Next

The British Columbia case will examine communications where LayerZero allegedly approved Kelps configuration and what duty infrastructure providers owe to clients that rely on their verifier networks.The civil claim challenges LayerZeros responsibility for the exploit.

Outcomes could range from dismissal or settlement to a judgment establishing clearer liability for bridge and messaging providers. Any finding that infra teams share responsibility for bridge losses would ripple across restaking, modular rollups, and cross-chain DeFi design.

On the technical side, watch for broader adoption of multi-verifier DVN setups, stricter rate limits on high-value transfers, and continued migration to alternatives like Chainlink CCIP. For users and protocols holding rsETH or similar assets, monitoring recovery efforts, bad-debt resolutions, and liquidity depth on major lending markets remains important.

Conclusion

The KelpDAO versus LayerZero dispute combines one of 2026s largest DeFi exploits with a rare legal challenge to cross-chain infrastructure. Regardless of the court outcome, the episode is already pushing the industry toward more resilient multi-verifier bridge designs and sharper questions about who ultimately bears risk when off-chain security fails.