KelpDAO Sues LayerZero Over $292M rsETH Exploit in British Columbia
KelpDAO filed a civil claim in British Columbia against LayerZero Labs and CEO Bryan Pellegrino over a $292 million exploit of its rsETH token that occurred in April. The lawsuit alleges LayerZero reviewed and approved the single-verifier bridge configuration later blamed for the attack, then warned another developer about the same security model.
Written by CoinArticle’s AI Newsroom · from 8 cited sources. How we work
Story Updates
- Updated Sep 26, 2026, 09:05 PM: Court filing confirmed in Supreme Court of British Columbia; allegations of written approval and selective warning disclosed.
- Updated Sep 26, 2026, 09:02 PM: New reporting reveals LayerZero allegedly approved single-verifier configuration in writing, then warned another developer about the same model.
- Updated Sep 26, 2026, 02:06 PM: Kelp users have withdrawn $650M+ since the attack; lawsuit seeks aggravated and punitive damages in addition to negligence claims.
- Updated Sep 25, 2026, 09:08 PM: Pellegrino publicly rejected the civil claim as meritless and confirmed he will defend the case in Vancouver courts.
- Updated Sep 25, 2026, 12:05 PM: Lawsuit allegations now include blame-shifting accusation; details sourced to both CoinDesk and Crypto Briefing.
- Updated Sep 25, 2026, 10:02 AM: CoinDesk reports KelpDAO alleges LayerZero failed to disclose protocol weaknesses that enabled the $292 million exploit.
The Filing and Core Allegations
Evercrest Technologies, the company behind KelpDAO, filed a civil claim in the Supreme Court of British Columbia against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and co-founder Bryan Pellegrino. The lawsuit stems from an April exploit that drained approximately $292 million in rsETH, KelpDAO's restaked Ethereum token. KelpDAO alleges negligence, negligent misrepresentation, and defamation, and seeks aggravated and punitive damages.
The core allegation: LayerZero reviewed and endorsed the bridge configuration in writing multiple times, then subsequently warned a different developer about the risks of that same configuration. If proven, this would suggest LayerZero identified the vulnerability but failed to disclose it to KelpDAO or remediate the risk. LayerZero and Pellegrino have rejected the claims as meritless; Pellegrino stated he would defend himself in Vancouver courts.
The Bridge Configuration at the Center of Dispute
The April exploit involved 116,500 rsETH moved through a bridge connecting KelpDAO infrastructure with Unichain. The assets were worth approximately $292 million at the time of the attack. The central technical dispute concerns the bridge's security configuration: KelpDAO alleges LayerZero explicitly reviewed and approved the single-verifier model that enabled the attack, despite knowing the risks of that approach.
The lawsuit underscores ongoing tension in decentralized finance over responsibility allocation when integrations between protocols result in significant losses. Whether LayerZero had an affirmative duty to disclose identified risks to integrating protocols—and the distinction between a vulnerability in LayerZero's infrastructure versus a flaw in KelpDAO's integration with it—will likely be central to the case's outcome.
User Withdrawals and Protocol Impact
Kelp users have withdrawn more than $650 million from the protocol since the April exploit, according to the lawsuit filing. The sustained outflows signal ongoing confidence erosion tied to both the original loss and the unresolved liability questions. The case outcome may establish precedent for omnichain operator responsibilities in DeFi more broadly.
Why It Matters
For Traders
rsETH and protocols using LayerZero face prolonged litigation uncertainty; $650M+ withdrawals reflect sustained user confidence erosion.
For Investors
Allegation of knowing risk disclosure failure could establish omnichain operators' affirmative duty to warn integrating protocols, reshaping DeFi liability standards.
For Builders
Projects integrating LayerZero must now maintain independent security reviews and document all vendor communications separately from infrastructure approvals.
This article is for information only and is not financial advice. Read the full disclaimer.
