preferred on
Points of Focus
- Evercrest Technologies sued LayerZero and CEO Bryan Pellegrino in British Columbia.
- The April 18 exploit released 116,500 rsETH worth about $292M without a matching burn.
- Kelp blames compromised LayerZero infrastructure, while LayerZero points to Kelp’s 1-of-1 verifier setup.
KelpDAO’s operator, Evercrest Technologies, has taken its dispute with LayerZero to court, filing a civil claim in British Columbia against LayerZero and co-founder and CEO Bryan Pellegrino over April’s $292 million rsETH bridge exploit.
Kelp said LayerZero failed to disclose technology risks and secure infrastructure later compromised by attackers. Pellegrino called the claim ‘meritless’ and said he would defend the case in Vancouver.
Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ. The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly.
— Bryan Pellegrino (臭企鹅) (@PrimordialAA) September 24, 2026
KelpDAO says LayerZero approved rsETH bridge setup
The complaint centers on the April 18 attack, which caused Kelp’s Ethereum bridge to release 116,500 rsETH worth roughly $292 million without a corresponding burn on the source chain. Kelp alleges LayerZero reviewed and approved its deployment and security configuration in writing before the exploit. No court has ruled on those claims.
Kelp’s lawsuit challenges LayerZero’s argument that the loss depended on Kelp’s 1-of-1 Decentralized Verifier Network configuration. Under that setup, the LayerZero Labs DVN was the only verifier required to approve a cross-chain message, leaving no second verifier to reject a forged message if the first was compromised.
Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH’s LayerZero bridge earlier this year. For more details, please refer to the statement below.https://t.co/gPQTPeM0Zh
— Kelp (@KelpDAO) September 25, 2026
LayerZero points to single verifier after infrastructure breach
LayerZero’s final incident report said the breach began when an attacker socially engineered a LayerZero developer, obtained session credentials and compromised internal RPC nodes used by its DVN. During the April 18 attack, a denial-of-service attack disrupted an external RPC provider, forcing the DVN to rely on compromised internal nodes and sign a forged cross-chain message.
LayerZero says the loss became possible because Kelp required only one verifier. Security firm Blockaid reached a similar technical finding, saying the compromised DVN and lack of a second verifier allowed the forged message to release the rsETH.
LayerZero later acknowledged its own role. In a May 8 update, the company said it made a mistake by allowing its DVN to act as the sole verifier for high-value transactions and accepted responsibility for failing to police what its verifier was securing.
Pellegrino rejects KelpDAO lawsuit
Pellegrino has rejected the civil claim as meritless and said he will defend himself and LayerZero in Vancouver. The lawsuit now moves the months-long dispute over responsibility into a British Columbia court.
The April attacker also attempted to release another 40,000 rsETH, but Kelp’s emergency multisig stopped the second forged packet before execution.
Share
Most read articles
