KelpDAO Sues LayerZero and Pellegrino in British Columbia Over 292M USD rsETH Exploit

KelpDAO has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino in British Columbia, turning April’s 292 million USD rsETH exploit from a public technical dispute into a civil court case over who bears responsibility for one of the largest DeFi thefts of the year.

Kelp said on September 24 that Evercrest Technologies Inc., the legal entity behind the protocol, filed the action over failures connected to LayerZero’s infrastructure. The April 18 attack drained 116,500 rsETH worth approximately 292 million USD from KelpDAO’s cross-chain bridge, minted on forged messages that passed through LayerZero’s verification layer.

What KelpDAO alleges

According to KelpDAO’s public account, the complaint alleges that LayerZero failed to disclose weaknesses and risks in its technology and failed to prevent attackers from penetrating the security infrastructure used by its verifier. No court has ruled on the allegations.

Pellegrino has already responded publicly. He called the claims meritless and said he will defend himself and LayerZero in Vancouver. The civil claim names both the company and Pellegrino personally.

A central pillar of Kelp’s case is configuration. The protocol says LayerZero reviewed and approved its rsETH bridge deployment and configuration in writing before the exploit, which contradicts LayerZero’s later argument that Kelp created a dangerous single-verifier setup on its own.

The competing accounts of the bridge setup

LayerZero’s April incident statement said Kelp used a 1-of-1 Decentralized Verifier Network, leaving no second verifier capable of rejecting a false cross-chain message. The company said it had recommended verifier diversification previously and described the configuration as a single point of failure. Pellegrino later said Kelp originally ran multi-DVN or DeadDVN defaults before manually changing the rsETH deployment.

Kelp disputes that account of the discussions and says its bridge followed LayerZero’s documented defaults while relying on LayerZero-operated infrastructure. Its lawsuit will reportedly lean on written records showing LayerZero signed off on the setup.

What actually happened on April 18

Both parties agree on the mechanics, which LayerZero’s May incident report detailed. An attacker socially engineered a LayerZero developer on March 6 and obtained session credentials, then entered LayerZero’s RPC cloud environment and altered internal nodes used by the LayerZero Labs DVN.

During the attack, the compromised nodes supplied false blockchain information while a denial-of-service attack disrupted external RPC providers. LayerZero’s DVN signed a forged message because the information available to it indicated the message was valid. Kelp’s Ethereum bridge then released 116,500 rsETH with no corresponding burn on the source chain.

A second attempt targeted another 40,000 rsETH, then worth roughly 95 million to 100 million USD, but Kelp had paused its contracts about 46 minutes after the first drain, blocking the forged packet from executing.

Chainalysis characterized the event as an attack on off-chain verification infrastructure rather than a smart contract vulnerability in rsETH itself. LayerZero and several researchers, including Mandiant and CrowdStrike, attributed the operation to the North Korea-linked TraderTraitor group associated with the Lazarus family. The attribution does not resolve the civil dispute between the two companies.

Security researchers documented both failures

Blockaid found that LayerZero’s sole DVN authenticated the false cross-chain message and that the absence of a second verifier allowed it to reach Kelp’s Ethereum adapter. Chainalysis reached a similar technical conclusion from the infrastructure side, finding the attackers manipulated LayerZero-operated RPC nodes feeding the DVN while forcing the verifier to depend on them.

LayerZero responded by ending support for 1-of-1 DVN configurations and moving affected applications toward multi-verifier setups, with a security model that requires more independent verification paths.

Kelp has already moved on technically

The lawsuit arrives months after Kelp restructured its bridge stack. In May it announced a migration of rsETH cross-chain transfers from LayerZero’s OFT framework to Chainlink CCIP, a decision made while the blame dispute was still running. By May 25, Kelp had transferred the final 20,373.72 rsETH tranche needed for its operational recovery plan, with minting, redemptions and rewards resumed.

The recovery also rippled through DeFi lending markets, because the attacker used stolen rsETH as collateral. Aave, Kelp and other participants organized a recovery process, with Kelp committing 2,000 ETH to the effort.

What happens next in Vancouver

The case now enters British Columbia’s Supreme Court process. Under the province’s civil rules, a defendant generally has 21 days to respond after service in Canada, 35 days after service in the United States, or 49 days when served elsewhere, unless the court sets another deadline.

The outcome could set a precedent for how infrastructure providers are held accountable when integrated protocols suffer losses, a question that has hung over bridge security since the earliest cross-chain hacks and that no major court has yet answered for a verifier layer of this kind.

Market snapshot at 12:00 UTC on Sept. 25, 2026: BTC 84,606 USD, ETH 2,716.64 USD, SOL 120.81 USD (CoinGecko).