- Published on
KelpDAO sues LayerZero for the largest exploit 2026 has seen so far
- Authors
- Name
- DeepHorus
KelpDAO has sued LayerZero and co-founder Bryan Pellegrino in British Columbia, alleging that undisclosed flaws enabled a $292 million exploit. The Ethereum liquid-staking protocol calls the April 22 attack the largest of 2026 so far. The case renews scrutiny of cross-chain security.
KelpDAO said attackers exploited weaknesses in LayerZero’s universal bridge after infiltrating its security infrastructure. A North Korean group was allegedly responsible, though attribution remains unproven. KelpDAO held nearly one-fifth of rsETH’s circulating supply when the breach occurred.
The attackers drained 116,500 rsETH, worth roughly $292 million, and triggered a broader liquidity crisis. The shock erased $20 billion in decentralized-finance total value locked within days. Aave, the largest DeFi lending pool, borrowed $300 million to meet increased withdrawal demand.
KelpDAO argued that LayerZero failed to disclose technological weaknesses and prevent the infiltration of its systems. It also accused LayerZero and Pellegrino of publicly shifting blame instead of taking responsibility. The lawsuit seeks accountability for harm to KelpDAO and the wider DeFi ecosystem.
Pellegrino called the civil claim meritless and said he would defend LayerZero and himself in Vancouver. He identified KelpDAO as Evercrest in his response. The dispute concerns whether bridge providers share responsibility for failures in systems built on their technology.
KelpDAO said it has protected users by migrating rsETH’s bridge to a more secure cross-chain standard. Experts, including those at JPMorgan, cited the incident as evidence of persistent DeFi risks. LayerZero’s network role means failures can spread rapidly across assets, markets and lending protocols.
The lawsuit could prompt stronger disclosure rules and security standards for cross-chain services. It may also clarify how DeFi projects allocate responsibility among developers, operators and technology vendors. With $292 million stolen and $20 billion in TVL erased, the case will test the industry’s ability to contain systemic losses.
