Key Takeaways:
- KelpDAO is suing LayerZero and co-founder Bryan Pellegrino for the April attack that resulted in 116,500 rsETH valued at approximately $292 million.
- According to KelpDAO, LayerZero has not reported key vulnerabilities; nor have it made efforts to secure its infrastructure used by its verification system.
- LayerZero has walked back KelpDAO’s claim, citing its 1-of-1 DVN settings as a factor in the exploits.
KelpDAO’s feud with LayerZero has crossed over from rhetoric and technical papers to law courts. The lawsuit is focused on the attack that drained 116,500 rsETH from KelpDAO’s LayerZero bridge in April and serves as a precursor to an ongoing source of tension between cross-chain security providers.
Read More: $290M KelpDAO Hack SHOCK: LayerZero Points to Fatal DVN Flaw, Lazarus Suspected
KelpDAO Takes LayerZero Dispute to Court
KelpDAO announced on Sept. 25 that it had filed a lawsuit against LayerZero and Bryan Pellegrino, LayerZero’s co-founder and CEO. The case seeks to hold the defendants responsible for losses and damage that KelpDAO says resulted from the exploit.
— Kelp (@KelpDAO) September 25, 2026
KelpDAO claims LayerZero did not reveal vulnerabilities and risks in its tech and was unable to protect against attackers exploiting infrastructure usage during the verification. The charges have not been substantiated in court.
Pellegrino has dismissed the lawsuit as frivolous and vowed to fight it out in Vancouver. So the issue of the law is the different sides’ perceptions of how the bridge had been made vulnerable.
The $292M rsETH Exploit
In all an attacker stole 116,500 rsETH, which at the time of the incident had a total value of approximately $292 million. According to LayerZero’s investigation, the attacker began to social engineer its way into the hands of a LayerZero developer, before infiltrating its RPC system.
The híjacked infrastructure provided defrauded data on the blockchain to LayerZero’s verification system. This enabled a malformed cross chain message to get a valid attestation.
The attackers did not exploit known vulnerabilities in KelpDAO’s smart contracts, as it was shown by Chainalysis. The false message eventually led to the release of rsETH, without any token burn in the source chain.
Why the 1-of-1 DVN Setup Is Central
According to LayerZero, KelpDAO’s rsETH was linked to a 1-of-1 Decentralized Verifier Network (DVN), where LayerZero Labs was the only verifier.
LayerZero says that had resulted in a single point of failure. If the verifier had been compromised by this attacker, there was no independent verifier to reject the forged message. LayerZero has said it had recommended multi-DVN redundancy.
KelpDAO denies that and states that it has been read and approved by LayerZero in writing to be deployed and configured. It’s a controversial assertion in the litigation.
Read More: BonkDAO Hit by $20M Treasury Hack After Malicious Governance Proposal Rocks BONK Holders
KelpDAO Moves rsETH Away From LayerZero
Following the exploit, KelpDAO shifted its focus to ensuring cross-chain security of its system. The protocol was rolled out to move the rsETH bridge away from the LayerZero layer-two infrastructure and into Chainlink CCIP.
LayerZero also responded to the incident by removing support of 1-of-1 DVN configurations for compromised applications and strengthening its infrastructure related to the attack.
The lawsuit now puts those technical disagreements under judicial scrutiny, with the key questions including responsibility for the compromised infrastructure, the bridge configuration, and the security warnings provided before the $292 million exploit.
