KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting

Evercrest Technologies, the developer of KelpDAO, has filed a lawsuit against LayerZero Labs, its Canadian entity and CEO Bryan Pellegrino over the exploit of the protocol’s rsETH bridge that caused roughly $292 million in losses.

In a complaint published on Sept. 24, Evercrest says the incident, which surfaced on April 18, was not caused by a vulnerability in KelpDAO’s contracts but by a combination of poisoned RPC data, a compromised developer device and a 1-of-1 LayerZero DVN configuration.

Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH’s LayerZero bridge earlier this year. For more details, please refer to the statement below.https://t.co/gPQTPeM0Zh

— Kelp (@KelpDAO) September 25, 2026

The filing alleges that an attacker compromised a LayerZero developer’s machine on March 6, 2026, before targeting the RPC infrastructure used by LayerZero’s Decentralized Verifier Network in April. The manipulated RPCs allegedly caused LayerZero’s DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place.

With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation allegedly resulted in the minting of $292 million in rsETH on Ethereum. Evercrest says it identified the attack within an hour, suspended its LayerZero bridges, froze the attacker’s wallet and stopped a second attempted mint of 40,000 rsETH.

Evercrest also disputes LayerZero’s public account of the incident, claiming that LayerZero had reviewed and endorsed KelpDAO’s bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup.

The complaint says LayerZero later blamed KelpDAO’s single-verifier configuration and Pellegrino said applications should not rely on a sole DVN, while Evercrest maintains it followed LayerZero’s written instructions.

Evercrest is seeking damages for a 2,000 ETH recapitalization, more than $650 million in user withdrawals, lost fee revenue, declines in KERNEL, the shutdown of KelpDAO’s sbUSD vault, a delayed stablecoin product, legal and migration costs and reputational harm.