KelpDAO sues LayerZero over $292M exploit. The Main Takeaways * KelpDAO has filed a $292 million lawsuit against LayerZero Labs over a significant exploit that drained rsETH due to alleged security failures. * LayerZero's Decentralized Verifier Network was compromised, allowing a forged message to facilitate the exploit without proper verification. * Following the incident, KelpDAO has transitioned its cross-chain transfers from LayerZero to Chainlink CCIP to enhance security. Evercrest Technologies Inc., the entity behind KelpDAO, has filed a civil claim in British Columbia against LayerZero Labs and co-founder Bryan Pellegrino over the April 18 exploit that drained 116,500 rsETH worth about $292 million. The loss is one the largest reported crypto exploits of 2026. Kelp alleges LayerZero failed to adequately disclose risks in its technology and failed to prevent attackers from penetrating infrastructure used to secure the rsETH bridge. It also says LayerZero had reviewed and endorsed Kelp's deployment and configuration in writing before the attack. Pellegrino has rejected the claim as meritless and said he will defend himself and LayerZero in Vancouver. Compromised verifier approved a forged message. LayerZero's incident report said the breach began in March when an attacker socially engineered a LayerZero developer, obtained session credentials and gained access to the company's RPC environment. During the April attack, compromised internal RPC nodes supplied false blockchain data while an external RPC provider was hit by a denial-of-service attack. LayerZero's Decentralized Verifier Network then produced a valid attestation for a cross-chain transaction that had never occurred. Kelp's rsETH bridge was configured to use the LayerZero Labs DVN as its only required verifier. With no second independent verifier needed, the forged message was accepted and 116,500 rsETH was released without a corresponding burn on the source chain. Chainalysis' analysis similarly found that the attack targeted off-chain verification infrastructure rather than a vulnerability in Kelp's token contracts. Lawsuit puts configuration dispute at the center. The case now turns in part on responsibility for the single-verifier setup. LayerZero initially said Kelp had selected a configuration that went against its recommendations, while Kelp disputes that account and argues LayerZero had approved the deployment. LayerZero later acknowledged that allowing its DVN to act as the sole verifier for high-value transactions was a mistake. Since the exploit, LayerZero has stopped its DVN from servicing 1-of-1 configurations, while Kelp has moved rsETH cross-chain transfers away from LayerZero and toward Chainlink CCIP. Mandy Williams is a full-time cryptocurrency reporter. Having entered the blockchain space in early 2017, she leverages a diverse background in multi-niche writing and content strategy to cover the evolving digital asset market. Mandy is dedicated to breaking down complex Web3 concepts and spreading mainstream awareness of blockchain technology.

KelpDAO sues LayerZero for the largest exploit 2026 has seen so far. September 25, 2026 - By CoinDesk - Original - Updated KelpDAO sues LayerZero for $292 million exploit, alleging undisclosed protocol weaknesses led to a major DeFi liquidity crisis. Confidence: 80% Horizon: short-term Key numbers. * 292 million * 116,500 rseth * 20 billion Market drivers (micro). * Increased scrutiny on cross-chain protocol security. * Potential legal repercussions for LayerZero affecting its operations. * Market reaction to DeFi vulnerabilities may lead to reduced user trust. Context (macro). * Ongoing concerns about security in the DeFi space. * Impact of hacking incidents on overall market confidence. Who wins / who loses. * Winners: KelpDAO may strengthen its security measures and user trust post-lawsuit. * Losers: LayerZero faces reputational damage and potential financial liabilities. Scenarios. Base KelpDAO's lawsuit leads to increased regulatory scrutiny and potential reforms in cross-chain protocol security. Alt LayerZero successfully defends itself, leading to minimal changes in the current DeFi security landscape. What to watch next. * Outcome of the lawsuit and its implications for DeFi security. * Market reaction to further developments in the case. * Potential regulatory changes in response to DeFi vulnerabilities. Full analysis. KelpDAO sues LayerZero over major DeFi exploit. KelpDAO has taken legal action against LayerZero and its co-founder, Brian Pellegrino, following a significant exploit that drained $292 million from their cross-chain lending protocol. The lawsuit claims that LayerZero failed to disclose critical weaknesses in its technology, which directly contributed to the exploit that occurred on April 22, 2026. Background of the exploit. The exploit resulted in the loss of 116,500 rseth, which was a substantial portion of the circulating supply of restaked tokens. This incident not only affected KelpDAO but also triggered a broader liquidity crisis within the decentralized finance (DeFi) ecosystem, leading to a staggering $20 billion being erased from total value locked (TVL) across various DeFi platforms. KelpDAO's allegations. KelpDAO alleges that LayerZero's lack of transparency regarding the risks associated with its protocol allowed attackers to exploit its vulnerabilities. The decentralized liquid staking protocol has stated that LayerZero and Pellegrino have publicly blamed KelpDAO for the incident instead of taking responsibility. In response, Pellegrino has labeled the lawsuit as meritless and has vowed to defend his position in a British Columbia court. Impact on the DeFi Ecosystem. The ramifications of the exploit have been severe, with significant aftershocks felt across stablecoin markets. Notably, Aave, one of the largest DeFi lending pools, had to borrow $300 million to accommodate increasing user withdrawal demands. Experts, including those from JPMorgan, have pointed out that this incident highlights the structural risks still present in the DeFi space. Moving forward. In light of the exploit, KelpDAO has taken steps to enhance the security of its user assets, including migrating its rseth bridge to a more secure cross-chain standard. The protocol emphasizes the need to hold LayerZero and Pellegrino accountable for the damage caused to both KelpDAO and the broader DeFi ecosystem. As the lawsuit unfolds, the crypto community will be watching closely to see how this case impacts the future of cross-chain protocols and the overall security landscape in DeFi.

$292 million rsETH exploit prompts Kelp DAO lawsuit against LayerZero, co-founder. September 25, 2026 The liquid restaking protocol accuses the cross-chain messaging firm of failures tied to a major loss of user funds Kelp DAO, the liquid restaking protocol behind the rsETH token, has filed a lawsuit against LayerZero and a co-founder of the cross-chain messaging network. The legal action centers on an exploit reported to have drained roughly $292 million in value tied to rsETH. Kelp DAO argues LayerZero bears responsibility for failures connected to the incident. LayerZero operates as interoperability infrastructure, allowing tokens and messages to move across different blockchains. Protocols like Kelp DAO rely on such bridges to keep restaked assets synchronized across networks. When cross-chain messaging systems fail or get exploited, the consequences can cascade into the protocols built on top of them. One report on the matter referenced an entity called Evercrest in connection with the lawsuit against LayerZero, while other coverage identified Kelp DAO directly as the plaintiff pursuing claims tied to the rsETH losses. The exact corporate or legal relationship between Kelp DAO and Evercrest, if any, has not been detailed in available reporting. Readers should treat the naming discrepancy as an open question pending further clarification from the parties involved. The $292 million figure represents one of the larger losses attributed to a single exploit event in the restaking sector this year. Restaking protocols pool staked ether and related assets, then extend that value across additional networks and applications to generate further yield. That layered structure has expanded the attack surface available to exploiters, since a vulnerability in a single dependency, such as cross-chain messaging, can expose funds across an entire ecosystem of connected products. Legal action against infrastructure providers marks an escalation in how DeFi protocols respond to exploits. Historically, many hacks were addressed through negotiated bounty payments, community treasury reimbursements, or silent write-offs. A formal lawsuit signals that affected parties increasingly view courts, rather than on-chain governance alone, as a venue for recovering losses and assigning liability. LayerZero has not issued a public response detailed in current reporting. The company has positioned itself as core infrastructure for cross-chain applications, and any liability finding could carry implications well beyond its relationship with Kelp DAO, given how widely its messaging protocol is integrated across decentralized finance. The case also raises broader questions about how responsibility gets allocated when multiple layers of software, from token contracts to bridging protocols, contribute to a single point of failure. Courts have limited precedent for resolving disputes rooted in smart contract architecture and multichain design. Sources disagree on this story. This article was published before the reports below were compared. The reporting above stands; what follows is where the published accounts do not agree. Reports on KelpDAO's lawsuit against LayerZero agree on the lawsuit and dollar figures but diverge on the exploit's date, with CoinDesk citing April 22 against other outlets' April 18. What all sources agree on. * KelpDAO, through its legal entity Evercrest Technologies Inc., sued LayerZero and co-founder/CEO Bryan Pellegrino in British Columbia. * The exploit drained 116,500 rsETH, worth approximately $292 million. * KelpDAO alleges LayerZero failed to disclose weaknesses/risks in its technology and did not prevent attackers from compromising security infrastructure tied to its verifier. * KelpDAO alleges LayerZero had reviewed and approved/endorsed the rsETH bridge's deployment and configuration in writing before the exploit. * Pellegrino called the lawsuit 'meritless' and said he would defend himself and LayerZero in Vancouver/British Columbia. Where the reports disagree. 1Date of the rsETH bridge exploit. KelpDAO has sued LayerZero and co-founder Bryan Pellegrino in British Columbia over the April 18 exploit that drained 116,500 rsETH worth approximately $292 million. crypto.news 2026-09-25 05:51 KelpDAO's case centers on an April 18 attack that emptied 116,500 rsETH, worth about $292 million at the time, from the protocol's bridge built on LayerZero's cross-chain messaging network. The Cryptonomist EN 2026-09-25 08:37 The April 18 attack resulted in the theft of 116,500 rsETH, worth about $292 million at the time, from Kelp's LayerZero-powered bridge. Cointelegraph 2026-09-25 08:51 The April 22 attack drained 116,500 rsETH and contributed to a broader liquidity crisis that erased $20 billion in decentralized finance deposits. CoinDesk 2026-09-25 08:58 What would settle it: The on-chain transaction records for the rsETH bridge drain, or LayerZero's published incident report timeline. What to make of it. Treat the lawsuit's filing, the $292 million/116,500 rsETH figures, and Pellegrino's 'meritless' response as established across sources; the exact date of the exploit is unresolved, with CoinDesk's April 22 conflicting with the April 18 date given by crypto.news, The Cryptonomist EN, and Cointelegraph. Market impact. A lawsuit of this size could pressure LayerZero's reputation among protocols that depend on its messaging infrastructure for cross-chain operations. Developers evaluating interoperability providers may factor in litigation risk alongside technical security audits going forward. For rsETH holders and the broader liquid restaking market, the case underscores the financial exposure tied to infrastructure dependencies. Any court findings on liability could influence how future protocols structure indemnification, insurance, or risk-sharing agreements with third-party infrastructure vendors. The lawsuit places renewed scrutiny on the security responsibilities of cross-chain infrastructure providers within the restaking ecosystem. Further details on both the plaintiff's identity and LayerZero's response are expected as the case proceeds. Frequently asked questions. What is Kelp DAO's rsETH token? rsETH is a liquid restaking token issued by Kelp DAO, representing staked and restaked ether that can be used across other DeFi applications. What role does LayerZero play in this dispute? LayerZero provides cross-chain messaging infrastructure that protocols like Kelp DAO use to move assets and data between blockchains, and it is named as a defendant in the lawsuit. Why is there confusion over who filed the lawsuit? Different reports have named either Kelp DAO or an entity called Evercrest as the plaintiff, and the precise relationship between the two has not been clarified in available reporting. How much was reportedly lost in the exploit? Reports cite a loss of approximately $292 million tied to the rsETH exploit at the center of the lawsuit.