Kelp DAO Sues LayerZero (ZRO) Over $292 Million rsETH Exploit

Kelp DAO Takes LayerZero to Court

Restaking protocol Kelp DAO has taken its $292 million grievance to court, filing suit against LayerZero (ZRO) and co-founder and CEO Bryan Pellegrino on September 25. The action was lodged through Kelp's legal entity, Evercrest Technologies Inc., with the Supreme Court of British Columbia in Canada, and names Pellegrino personally alongside the protocol company. In its claim, Kelp argues that LayerZero concealed defects in its own cross-chain messaging technology and failed to stop attackers from penetrating its security infrastructure — failures it says directly produced the largest DeFi exploit of 2026. The dispute traces back to April 18, when attackers drained roughly 116,500 rsETH, Kelp's liquid restaking token, through a bridge secured by LayerZero's messaging layer. Security investigators later attributed the theft to TraderTraitor, a subgroup of North Korea's Lazarus Group. The intrusion was methodical: the hackers first obtained a session key by social-engineering a LayerZero developer account, then poisoned internal RPC cloud nodes while flooding external ones with DDoS traffic, forcing the bridge onto the compromised data path. With forged cross-chain messages in circulation, the verifier approved an rsETH burn that never actually happened, and the Ethereum contract released funds against it. The blast radius was immediate — Aave's total value locked fell by $8.45 billion within two days, and collateral locked across DeFi liquidity pools dropped broadly on major chains.

One Verifier, Two Versions

At the core of the litigation sits a single configuration choice: whether the bridge's security rested on one verifier or several. Kelp contends the 1-of-1 decentralized verifier network (DVN) setup — a single validating party — was the default option in LayerZero's own documentation and quickstart guide, and that the LayerZero team reviewed and endorsed the deployment in writing. LayerZero and Pellegrino have spent months arguing the reverse: that Kelp departed from recommended practice by manually downgrading a safer multi-verifier arrangement to the single-verifier layout, creating the very single point of failure the hackers exploited. Kelp DAO went public with the filing through its official X account on September 25, announcing the lawsuit, and the defense response was blunt. Pellegrino dismissed the claim as “meritless” and said he intends to contest it fully in a Vancouver courtroom. Kelp, meanwhile, has already acted on the security front: after the hack, the protocol migrated rsETH's bridging infrastructure to Chainlink CCIP, a rival cross-chain messaging standard it judges more robust. Fund recovery is also entangled in litigation — in May, a US court order blocked the Arbitrum DAO from moving 30,766 ETH it had frozen from the hacker, a tranche that now sits alongside the new Canadian proceedings. Readers tracking the market in real time can follow live spot and futures prices on Bitget.

@KelpDAO · X post

Announcing the lawsuit.

View on X

A Liability Test for Bridges

The court filing itself adds new detail to the dispute. The notice of civil claim is dated September 24 and pleads three causes of action — negligent misrepresentation, negligence and defamation — with aggravated and punitive damages sought on the defamation count; it names no sum but asserts the exploit and LayerZero's public statements have inflicted "tens of millions of dollars of damages" on Evercrest. Kelp alleges LayerZero endorsed the 1-of-1 verifier setup in written messages in February 2024, March 2024 and January 2025, at one point telling it to copy another single-verifier bridge, and that LayerZero warned USDT0 about default-configuration risks but never warned Kelp. The filing also dates the breach to March 6, when malware was installed on a LayerZero developer's computer, and says users have withdrawn over $650 million since the exploit while Kelp staked 2,000 ETH to restore rsETH's backing.

(as of 10:51 UTC) COINOTAG analysis: the claim now before the British Columbia Supreme Court is more than a bilateral quarrel over one bridge. Whatever the court holds on the disputed written endorsement, the case will help define how much responsibility a cross-chain infrastructure provider bears for exploits executed on a client's deployment — and whether default configurations carry implied assurance. Naming the CEO personally signals Kelp intends to test individual accountability, not only corporate liability. The legal cloud lands on top of routine supply mechanics too: LayerZero (ZRO) unlocked 25.71M tokens worth about $26 million on September 20, keeping issuance in focus while the Vancouver docket becomes an early template for bridge-exploit litigation across the altcoin infrastructure sector.