KelpDAO Takes LayerZero to Court Over $292M Bridge Exploit
The fight over one of 2026’s largest DeFi exploits has moved to court.
Summary:
- Kelp alleges LayerZero failed to adequately disclose risks in the infrastructure securing the rsETH bridge.
- LayerZero says Kelp chose a 1-of-1 verifier configuration despite recommendations to use multiple independent DVNs.
- The dispute puts responsibility for configurable cross-chain security at the center of a Canadian civil case.
Evercrest Technologies, the company associated with KelpDAO, filed a civil claim in British Columbia against LayerZero Labs and its co-founder and CEO Bryan Pellegrino on September 24 in X.
Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ. The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly.
— Bryan Pellegrino (臭企鹅) (@PrimordialAA) September 24, 2026
The lawsuit follows the April 18 attack on KelpDAO’s rsETH bridge, which released 116,500 rsETH worth approximately $292 million after attackers compromised infrastructure used by LayerZero’s verification system.
The lawsuit does not dispute that LayerZero infrastructure was compromised or that Kelp’s bridge relied on a single verifier. Instead, the fight centers on who was responsible for allowing those two conditions to exist together.
How the $292M Exploit Actually Worked
The attackers did not exploit a vulnerability in the rsETH smart contract. They manipulated the off-chain infrastructure responsible for telling the contract whether a legitimate cross-chain transaction had occurred.
According to LayerZero’s final incident report, the compromise began on March 6 when an attacker socially engineered a LayerZero developer, obtained session keys and gained access to the company’s RPC cloud environment. The attacker then poisoned internal RPC nodes used by the LayerZero Labs Decentralized Verifier Network, or DVN.
The attacker later disrupted an external RPC provider. That forced LayerZero’s DVN signing service to rely on two compromised internal nodes, which supplied false blockchain data and caused the DVN to generate a valid attestation for a forged cross-chain message.
Kelp’s bridge was particularly exposed because it used a 1-of-1 DVN configuration. LayerZero Labs was the only verifier required to approve the message. Once that DVN signed the forged message, there was no second independent verifier required to reject it.
At 17:35 UTC on April 18, the Ethereum-side bridge released 116,500 rsETH even though no corresponding token burn had occurred on Unichain. Aave’s incident analysis later confirmed that the forged packet was accepted with a single DVN attestation.
Chainalysis reached the same basic conclusion: the attack targeted off-chain infrastructure rather than exploiting the underlying smart contracts.
Kelp paused the affected contracts roughly 46 minutes after the successful drain. Two subsequent attempts involving another 40,000 rsETH failed after the pause.
Kelp Says LayerZero Backed the Security Setup
The lawsuit shifts attention from how the exploit worked to who should bear responsibility for the loss.
Kelp alleges that LayerZero failed to adequately disclose weaknesses and risks in its technology and failed to prevent attackers from compromising infrastructure used by its verification system. It also claims LayerZero had reviewed and endorsed Kelp’s deployment and configuration in writing. Those are allegations in a civil dispute and have not been established by the court.
Kelp had already challenged LayerZero’s account shortly after the April attack.
LayerZero argued that Kelp ignored recommendations to diversify its verifier setup. Kelp countered that the 1-of-1 structure was consistent with LayerZero’s default onboarding configuration and disputed claims that it had repeatedly been warned to change it.
That history could now become important to the civil case because the dispute extends beyond what the protocol technically allowed. It also concerns what LayerZero communicated to Kelp while the bridge was being deployed.
LayerZero Says Kelp Chose the Single Point of Failure
LayerZero’s position is different.
Its cross-chain protocol allows applications to select the DVNs responsible for verifying their messages. LayerZero says its recommended security model uses multiple independent DVNs so that compromising one verifier is not enough to authorize a fraudulent transaction.
In its April incident statement, LayerZero said Kelp’s 1-of-1 configuration created a single point of failure and that both LayerZero and outside parties had previously recommended DVN diversification.
READ MORE: Crypto Users Warned After FomoPeek iOS App Exposes Private Keys
Under a multi-DVN configuration, compromising LayerZero’s own verifier would not have been sufficient to authorize the forged message because additional independent verifiers would also have needed to approve it.
Pellegrino has rejected the lawsuit, calling the claims “meritless” and saying LayerZero intends to defend the case in Vancouver.
Where Kelp and LayerZero Disagree
What the Court Will Have to Resolve
The technical sequence behind the attack is now relatively clear. The harder issue is how responsibility was divided between the infrastructure provider and the application using it.
LayerZero operated the DVN infrastructure that attackers compromised. Kelp configured its bridge so that the LayerZero Labs DVN alone could authenticate the relevant messages.
The lawsuit therefore puts several practical questions under scrutiny: what security risks LayerZero disclosed, what recommendations it gave Kelp, whether LayerZero approved the final configuration, and how much responsibility remained with Kelp because applications can configure their own verifier networks.
That distinction matters beyond rsETH.
LayerZero’s modular architecture gives applications control over how cross-chain messages are verified. The model offers flexibility, but it also creates a division between the infrastructure operated by LayerZero and the security configuration selected by the application.
The British Columbia case could provide a closer look at how those responsibilities were represented between the two companies. It is too early, however, to know whether the litigation will produce a broader legal precedent.
Kelp Rebuilt the Bridge Around Four Attestors
Kelp changed its security architecture within days of the exploit.
By April 29, verification required four independent attestors: Canary, Horizen, LayerZero Labs and Nethermind. All four were required to approve messages in both directions, with separate infrastructure and RPC endpoints.
The change directly removed the single-verifier structure at the center of the April attack.
Kelp has also said it is migrating rsETH toward a different cross-chain standard as part of its broader security response.
The technical weakness that allowed one compromised verifier to authorize the forged message has therefore already been addressed in Kelp’s bridge architecture.
The question now before the court is different: who was responsible for the security decisions and infrastructure failures that allowed $292 million of rsETH to leave the bridge in the first place?
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Zdravkov
Reporter at CoinsPress
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 10,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
