KelpDAO Files Lawsuit Against LayerZero, CEO Over $292M rsETH Exploit

KelpDAO has escalated its legal fight over a major cross-chain bridge exploit by filing a lawsuit against LayerZero, alleging that shortcomings in LayerZero’s security infrastructure helped enable the theft of roughly $292 million worth of rsETH earlier this year.

The filing, first reported by KelpDAO and reported in related coverage of the incident, targets LayerZero as well as its co-founder and CEO, Bryan Pellegrino. KelpDAO says LayerZero did not adequately disclose risks and failed to stop attackers from compromising its infrastructure, while it also alleges LayerZero reviewed and endorsed KelpDAO’s bridge deployment and configuration in writing.

Key takeaways

• KelpDAO claims LayerZero’s technology and security infrastructure contributed to the April rsETH bridge exploit that stole 116,500 rsETH.
• The lawsuit alleges LayerZero failed to disclose relevant risks and did not prevent attackers from compromising its internal systems.
• KelpDAO also alleges LayerZero reviewed and endorsed KelpDAO’s bridge configuration and deployment in writing before the incident.
• LayerZero previously attributed the loss to attackers compromising its internal nodes and approval process, while arguing KelpDAO’s setup relied too heavily on a single verification path.
• Pellegrino rejected the allegations as “meritless” and said he plans to defend the case in Vancouver.

From exploit to courtroom dispute

The legal move follows the April 18 attack, which resulted in the theft of 116,500 rsETH from Kelp’s LayerZero-powered bridge. According to earlier reporting from Cointelegraph, the haul was valued at about $292 million at the time.

In its account of the incident, LayerZero said attackers compromised its internal nodes and manipulated the verifier into approving a forged cross-chain message. LayerZero argued that the theft was possible because the bridge design relied on a single decentralized verifier network (DVN) as the only verification path.

LayerZero also said it recommended using multiple DVNs and later stopped acting as the sole required verifier for applications, an important detail because it suggests the protocol changed its posture after the incident. KelpDAO, however, disputes that narrative and argues that the core failure lies with LayerZero’s security practices.

KelpDAO’s accusations against LayerZero

KelpDAO said LayerZero failed to disclose risks in its technology and did not prevent attackers from compromising LayerZero’s infrastructure. The lawsuit further alleges that LayerZero reviewed and endorsed KelpDAO’s deployment and configuration in writing before the exploit.

KelpDAO framed the case as both a security response and an effort to correct what it sees as an inaccurate public record about responsibility for the breach. In a statement shared via KelpDAO’s account, the group emphasized that protecting users’ assets remains its top priority, while it seeks to hold LayerZero and Pellegrino accountable for the harm it says was caused to KelpDAO and the broader DeFi ecosystem.

Separately, KelpDAO also targeted the question of disclosure—essentially arguing that even if a bridge design includes certain dependencies, users and operators must be clearly informed about risks and threat models associated with those dependencies.

LayerZero’s stance: internal compromise and verifier design

LayerZero’s position, as described in prior coverage, focused on what happened inside its own system and why the message verification pathway worked the way it did. In its final incident report cited by Cointelegraph, LayerZero said internal nodes were compromised and that a forged cross-chain message was approved by its verifier.

LayerZero argued that the bridge released rsETH after receiving approval for the forged message—pointing to the fact that there was no requirement for a second independent verifier in the setup used for that deployment.

That distinction matters because it frames the dispute as more than a question of whether something went wrong; it becomes a debate over whether the dominant failure mode was inside LayerZero’s infrastructure, inside KelpDAO’s configuration choices, or a combination of both.

LayerZero also said it recommended the use of multiple DVNs and later stopped acting as the sole required verifier for applications—implying that the system design risk was mitigated after the exploit. The lawsuit, by contrast, suggests KelpDAO believes these controls and warnings should have been in place earlier.

Pellegrino rejects the claims; responsibility remains contested

LayerZero co-founder and CEO Bryan Pellegrino responded by calling KelpDAO’s claims “meritless,” according to a post shared on X. He also said he would defend the case in Vancouver.

The lawsuit therefore intensifies a dispute that had been brewing for months after the April incident. As Cointelegraph previously reported, the arguments have repeatedly returned to the same central fault line: whether the loss was caused primarily by compromise of LayerZero’s infrastructure, weaknesses or decisions in KelpDAO’s bridge configuration, or both.

In May, KelpDAO publicly disputed LayerZero’s account of responsibility. KelpDAO said that its DVN configuration had been previously discussed with LayerZero and “confirmed as secure,” while it accused LayerZero of failing to adequately warn it about the risks. In that period, KelpDAO also announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol.

That migration plan is relevant to investors and users because it shows that KelpDAO did not wait for legal clarity to alter its operational posture. Still, legal filings aim to determine accountability—how the incident is ultimately characterized and who is held responsible for losses.

Cointelegraph attempted to obtain additional comment from LayerZero but did not receive a response before publication, according to the earlier reporting included in the source material.

For now, the key thing to watch is how the court frames the alleged “shared failure” described by each side—especially the claims around risk disclosure and whether LayerZero’s alleged written endorsement of KelpDAO’s configuration becomes central evidence. As the case develops, the most important unanswered question remains whether the evidence supports KelpDAO’s view that LayerZero’s security infrastructure and communications were the decisive factors, or whether LayerZero can persuade the court that the exploit was driven mainly by configuration choices at the application layer.