- Published on
KelpDAO sues LayerZero for the largest exploit 2026 has seen so far
- Authors
- Name
- DeepHorus
Evercrest, the team behind the decentralized liquid-staking protocol KelpDAO, has sued LayerZero and co-founder Bryan Pellegrino in British Columbia over an April 22 cross-chain exploit that moved $292 million in assets. The lawsuit, announced in a social-media post on Thursday, describes the incident as the largest exploit of 2026 so far. It alleges that undisclosed weaknesses in LayerZero’s technology enabled the attack, while also accusing the bridge operator and its co-founder of failing to prevent infiltration of KelpDAO’s security infrastructure.
KelpDAO operates on Ethereum and issues rsETH, a restaked liquid-staking token designed to represent staked Ether while remaining usable within decentralized finance. At the time of the April 22 incident, the protocol was associated with nearly one-fifth of rsETH’s circulating supply, making the reported loss of 116,500 tokens especially significant. A North Korean hacking group allegedly compromised a cross-chain bridge and drained those rsETH holdings. KelpDAO maintains that the loss resulted from LayerZero’s failures rather than shortcomings for which its own users should bear responsibility.
In its legal notice, KelpDAO said attackers exploited weaknesses in the universal bridge’s underlying technology after LayerZero failed to disclose those inherent risks. The protocol further alleges that the attackers gained access to its security infrastructure, turning a bridge vulnerability into a direct loss of deposited assets. Those statements are allegations central to the civil claim, not established findings by a court. Nevertheless, the case places responsibility for a shared cross-chain security model at the center of a major dispute between blockchain infrastructure providers and application operators.
The financial shock extended beyond KelpDAO’s treasury. The report accompanying the lawsuit said the incident forced Aave, the largest decentralized-finance lending pool, to borrow $300 million to address increased demand for withdrawals. It also linked the exploit’s aftermath to a broader liquidity crisis that removed $20 billion from total value locked across decentralized finance. The sharp contraction illustrated how a single bridge compromise can transmit liquidity stress across lending markets, restaking systems and stablecoin venues, even when the initial theft targets one protocol.
Pellegrino immediately rejected the allegations and said KelpDAO’s notice of civil claim was meritless. In a social-media response, he said he would defend himself and LayerZero in British Columbia and added, “I will meet them in Vancouver and defend myself accordingly.” The cited response did not address the reported stolen assets or provide supporting details about KelpDAO’s security allegations. The competing positions leave the lawsuit’s merits and the allocation of technical responsibility unresolved at this early stage.
KelpDAO said it has since taken protective measures, including migrating rsETH’s bridge to what it described as a more secure cross-chain security standard. The project also said it wants to “correct the record” and hold LayerZero and Pellegrino accountable for harm to the protocol and the wider DeFi ecosystem. Any migration, however, must now demonstrate that the original bridge vulnerabilities cannot be reproduced. The supplied material does not indicate when all affected funds might be recovered or whether users have been fully compensated.
The dispute is likely to become a test for liability and transparency in decentralized infrastructure. LayerZero sits beneath multiple blockchain applications, so questions about undisclosed vulnerabilities, security responsibilities and warning obligations could influence future contracts and audits. Regulators and industry participants may press for clearer bridge-risk disclosures, incident-response duties and compensation arrangements before capital moves between chains. For users, the broader lesson is that cross-chain and restaking opportunities remain inseparable from concentrated technical and operational risk. Legal action may clarify responsibility, but it cannot substitute for stronger controls, independent testing and carefully bounded exposure.
