KelpDAO Sues LayerZero And CEO Bryan Pellegrino Over $292 Million rsETH Bridge Hack

Lawsuit over $292M exploit

KelpDAO sued LayerZero and its co-founder and CEO Bryan Pellegrino in British Columbia, alleging that LayerZero’s failures enabled a $292 million hack tied to KelpDAO’s rsETH bridge. KelpDAO said, "The exploit was a direct result of LayerZero’s failures, including a failure to disclose weaknesses and risks inherent in LayerZero’s own technology," and the filing tied the incident to an April 22 attack that drained 116,500 rsETH. Pellegrino responded that the claim was meritless and said, "I will meet them in Vancouver and defend myself accordingly," as the dispute moved from public technical arguments into a civil case.

LayerZero’s position framed the loss as possible because Kelp’s bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path, and LayerZero said it had recommended using multiple DVNs. KelpDAO said it also accused LayerZero of failing to prevent infiltration of its security infrastructure, which it said allowed attackers to exploit the universal bridge’s alleged weaknesses.

@coindesk

SourcesCoinDeskCointelegraph

Competing blame, court venue

Pellegrino posted that Evercrest (KelpDAO) filed a notice of civil claim in British Columbia and told the parties, "The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly."

KelpDAO argued that LayerZero and Pellegrino "publicly blamed us for their failures" and said it needed to hold them accountable for harm to the broader DeFi ecosystem.

bitcoin.es

The lawsuit centered on a dispute over whether LayerZero’s security infrastructure was compromised or whether KelpDAO’s bridge configuration created the vulnerability, with the April 18 attack described as stealing 116,500 rsETH worth about $292 million.

LayerZero’s final incident report said attackers compromised infrastructure it operated before a forged cross-chain message was approved, and it said the bridge released rsETH after receiving LayerZero’s verifier approved the forged message.

KelpDAO said it had since moved rsETH’s bridge to "a more secure cross-chain security standard," while LayerZero said it stopped acting as the sole required verifier for applications.

SourcesCoinDeskCointelegraph

Aftermath and what is at stake

KelpDAO said the April exploit drained 116,500 rsETH and that the aftershocks spread across stablecoin markets, including forcing Aave to borrow $300 million to meet increasing user demand for withdrawals. CoinDesk reported that days later the exploit erased $20 billion in total value locked (TVL), and KelpDAO said the incident exposed structural risks in DeFi. KelpDAO framed the lawsuit as a way to "correct the record" and seek accountability for the damage it said LayerZero and Pellegrino caused to it and the broader DeFi ecosystem.

LayerZero’s response described a path forward that included replacing compromised verifier nodes, stopping signing messages for new single-verifier setups, and pushing integrated projects toward multi-verifier redundancy. The dispute also raised questions about how responsibility is divided when shared cross-chain infrastructure fails, with the case potentially shaping how future DeFi protocols negotiate liability for bridge providers.

SourcesCoinDesk