KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting

KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting

Evercrest Technologies alleges that LayerZero-owned infrastructure was compromised and enabled attackers to mint tokens without corresponding deposits.

Share

Add us on Google
by Vivian Nguyen

Evercrest Technologies, the developer of KelpDAO, has filed a lawsuit against LayerZero Labs, its Canadian entity and CEO Bryan Pellegrino over the exploit of the protocol’s rsETH bridge that caused roughly $292 million in losses.

In a complaint published on Sept. 24, Evercrest says the incident, which surfaced on April 18, was not caused by a vulnerability in KelpDAO’s contracts but by a combination of poisoned RPC data, a compromised developer device and a 1-of-1 LayerZero DVN configuration.

Advertisement

The filing alleges that an attacker compromised a LayerZero developer’s machine on March 6, 2026, before targeting the RPC infrastructure used by LayerZero’s Decentralized Verifier Network in April. The manipulated RPCs allegedly caused LayerZero’s DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place.

With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation allegedly resulted in the minting of $292 million in rsETH on Ethereum. Evercrest says it identified the attack within an hour, suspended its LayerZero bridges, froze the attacker’s wallet and stopped a second attempted mint of 40,000 rsETH.

Evercrest also disputes LayerZero’s public account of the incident, claiming that LayerZero had reviewed and endorsed KelpDAO’s bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup.

The complaint says LayerZero later blamed KelpDAO’s single-verifier configuration and Pellegrino said applications should not rely on a sole DVN, while Evercrest maintains it followed LayerZero’s written instructions.

Evercrest is seeking damages for a 2,000 ETH recapitalization, more than $650 million in user withdrawals, lost fee revenue, declines in KERNEL, the shutdown of KelpDAO’s sbUSD vault, a delayed stablecoin product, legal and migration costs and reputational harm.

Disclosure: This article was edited by Vivian Nguyen. For more information on how we create and review content, see our Editorial Policy.
REGULATION
KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting
KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting

Evercrest Technologies alleges that LayerZero-owned infrastructure was compromised and enabled attackers to mint tokens without corresponding deposits.

by Vivian Nguyen

Share

Add us on Google

Evercrest Technologies, the developer of KelpDAO, has filed a lawsuit against LayerZero Labs, its Canadian entity and CEO Bryan Pellegrino over the exploit of the protocol’s rsETH bridge that caused roughly $292 million in losses.

In a complaint published on Sept. 24, Evercrest says the incident, which surfaced on April 18, was not caused by a vulnerability in KelpDAO’s contracts but by a combination of poisoned RPC data, a compromised developer device and a 1-of-1 LayerZero DVN configuration.

Advertisement

The filing alleges that an attacker compromised a LayerZero developer’s machine on March 6, 2026, before targeting the RPC infrastructure used by LayerZero’s Decentralized Verifier Network in April. The manipulated RPCs allegedly caused LayerZero’s DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place.

With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation allegedly resulted in the minting of $292 million in rsETH on Ethereum. Evercrest says it identified the attack within an hour, suspended its LayerZero bridges, froze the attacker’s wallet and stopped a second attempted mint of 40,000 rsETH.

Evercrest also disputes LayerZero’s public account of the incident, claiming that LayerZero had reviewed and endorsed KelpDAO’s bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup.

The complaint says LayerZero later blamed KelpDAO’s single-verifier configuration and Pellegrino said applications should not rely on a sole DVN, while Evercrest maintains it followed LayerZero’s written instructions.

Evercrest is seeking damages for a 2,000 ETH recapitalization, more than $650 million in user withdrawals, lost fee revenue, declines in KERNEL, the shutdown of KelpDAO’s sbUSD vault, a delayed stablecoin product, legal and migration costs and reputational harm.

Disclosure: This article was edited by Vivian Nguyen. For more information on how we create and review content, see our Editorial Policy.