KelpDAO Sues LayerZero Over $292M Security Breach
Lawsuit accuses bridge provider of failing to disclose vulnerabilities in rsETH exploit.
1Legal action over $292M exploit
KelpDAO has filed a lawsuit in British Columbia against LayerZero and its CEO Bryan Pellegrino, alleging security failures led to a $292 million exploit of its rsETH token in April 2026. The protocol claims LayerZero failed to disclose technology weaknesses and prevent infrastructure infiltration. This marks KelpDAO's most direct attempt to hold LayerZero accountable after months of public dispute about breach causes. The lawsuit challenges LayerZero's narrative that the attack was isolated to KelpDAO's configuration.
2Dispute over security configuration
The conflict centers on LayerZero's 1-of-1 Decentralized Verifier Network (DVN) setup, where its own DVN served as sole verifier. KelpDAO maintains this configuration followed LayerZero's official documentation and default practices, despite LayerZero's claim it recommended multiple DVNs to avoid single points of failure. In a May 6 report, KelpDAO pushed back against suggestions it went against guidance, arguing the setup wasn't unusual. The protocol alleges LayerZero reviewed and endorsed its deployment in writing.
3Scale of the security breach
The rsETH exploit was the largest crypto security incident of 2026 until subsequent hacks on Liquid Network and Bitget. Cyvers estimated $293.7 million in rsETH was drained, with assets moved across Ethereum and Arbitrum. The attack also affected major lending protocols including Aave V3, Compound V3, and Euler. KelpDAO's lawsuit seeks to hold LayerZero accountable for these damages, claiming the company publicly blamed KelpDAO rather than taking responsibility for security failures.
4LayerZero's response
CEO Bryan Pellegrino responded within hours on X, confirming KelpDAO's parent entity Evercrest filed a civil claim against him and LayerZero in British Columbia. He called the claim meritless and stated his intention to defend himself in Vancouver. The public dispute highlights tensions in DeFi security accountability, with LayerZero maintaining its recommendations for multiple DVNs could have prevented the exploit while KelpDAO insists the approved configuration followed standard practices.
5Industry context of the lawsuit
The lawsuit occurs amid broader DeFi security challenges, with Solana Foundation's Seraphim Czecker describing the environment as high-stakes where projects either succeed massively or face existential threats. The KelpDAO case exemplifies the legal risks following major exploits, where protocols may face years of court battles. This incident follows a pattern of bridge-related vulnerabilities being exploited for hundreds of millions, raising questions about security standards across interoperability solutions.
6Documentation versus recommendations
A key dispute centers on whether LayerZero's documentation sufficiently warned against single-DVN configurations. KelpDAO claims it followed official guidance, while LayerZero argues it advised against such setups. This discrepancy highlights challenges in decentralized security responsibility, where protocol teams must interpret and implement complex technical recommendations. The case may set precedents for liability in multi-party DeFi security failures, particularly around bridge technologies.
7Asset movement post-exploit
Following the exploit, the attacker moved drained rsETH assets into ETH across Ethereum and Arbitrum networks. The widespread impact on multiple lending protocols suggests the attacker strategically targeted interconnected DeFi systems. This movement pattern reflects common post-exploit laundering techniques, where attackers disperse funds across chains and protocols to obscure tracing. The scale of asset movement complicated recovery efforts and increased the exploit's systemic impact across DeFi ecosystems.
8Implications for DeFi security
The lawsuit underscores growing legal pressures on infrastructure providers following major exploits. As DeFi matures, courts may increasingly be asked to adjudicate technical disputes about security implementations and responsibilities. The case could influence how bridge providers document configurations and communicate risks, potentially leading to more explicit warnings or restrictions on certain setups. For projects, it highlights the importance of thorough security audits and clear contractual understandings with infrastructure partners.
Original article: CryptoPotato — KelpDAO Sues LayerZero Over $292M Security Breach