TL;DR
- Legal action: KelpDAO is suing LayerZero and co-founder Bryan Pellegrino over the $292 million exploit, arguing that weaknesses and security failures connected to the universal bridge enabled the attack.
- DeFi impact: The April 22 attack allegedly drained 116,500 rsETH and created pressure across decentralized finance.
- Security response: The protocol says it has since moved the rsETH bridge to a more secure cross-chain security standard to protect user assets.
KelpDAO has taken its dispute with LayerZero into court, filing a lawsuit against the universal bridge protocol and co-founder Bryan Pellegrino over the $292 million exploit that hit the liquid staking project. Kelp says failures tied to LayerZero’s technology and security contributed directly to the attack, an incident that later rippled across decentralized finance markets.
— Kelp (@KelpDAO) September 25, 2026
Lawsuit Puts Responsibility for the Exploit at Center Stage
In its complaint, Kelp accused LayerZero of failing to disclose weaknesses and risks within its technology. The protocol also claimed LayerZero failed to prevent attackers from infiltrating its security infrastructure, creating conditions that allowed alleged weaknesses in the universal bridge to be exploited. The legal action follows months of public disagreement over responsibility for the incident. KelpDAO said LayerZero and Pellegrino had blamed the protocol for their own failures instead of accepting responsibility.
Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ. The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly.
— Bryan Pellegrino (臭企鹅) (@PrimordialAA) September 24, 2026
Pellegrino quickly rejected the accusations. He said Evercrest, identified in his response with KelpDAO, had filed a notice of civil claim in British Columbia against himself and LayerZero. Calling the claim meritless, he said he would meet the plaintiffs in Vancouver and defend himself in court.
$292 Million Attack Sent Shockwaves Across DeFi
The dispute stems from an April 22 attack that KelpDAO said involved its cross-chain bridge. A North Korean hacking group allegedly drained 116,500 rsETH worth roughly $292 million. At the time, the bridge held nearly one-fifth of the restaked token’s circulating supply. The fallout extended beyond KelpDAO.
Stablecoin markets came under pressure, and Aave reportedly borrowed $300 million to meet rising user demand for withdrawals. Days after the incident, $20 billion in total value locked had been erased, highlighting concerns about structural security risks across DeFi.
Bridge Migration Follows Security Response
Since the exploit, KelpDAO says it has taken steps to keep user assets safe, including moving the rsETH bridge to what it described as a more secure cross-chain security standard. The lawsuit now shifts the dispute from public statements into a Canadian courtroom. For KelpDAO, the legal action is also about correcting the record. KelpDAO says it wants LayerZero and Pellegrino held accountable for damage it believes they caused to the protocol and the DeFi ecosystem.
