The developer behind liquid restaking protocol KelpDAO has taken LayerZero Labs and its co-founder and chief executive, Bryan Pellegrino, to court over an April 2026 cross-chain exploit that released about 116,500 rsETH, then worth roughly $292 million.
Evercrest Technologies, the company that builds and operates KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia on September 24, 2026.
The action names LayerZero Labs Ltd., LayerZero Labs Canada Inc., and Pellegrino personally.
It alleges negligent misrepresentation, negligence, and defamation, and seeks damages that include aggravated and punitive awards.
— Kelp (@KelpDAO) September 25, 2026
The claim centers on KelpDAO’s Unichain bridge, which used a 1-of-1 decentralized verifier network (DVN) arrangement in which LayerZero’s own verifier was the only party required to confirm that tokens had been locked on one chain before equivalent tokens were minted on another.
Evercrest argues that this was not an unauthorized shortcut.
According to the filing, LayerZero reviewed the implementation and, in written messages in February 2024, March 2024, and later, said the default configuration was acceptable and directed the team to use a single-verifier setup with LayerZero’s own DVN.
Evercrest further alleges that LayerZero did not warn it of the risks of that design even though it had cautioned another developer about similar defaults.
On April 18, 2026, attackers used forged cross-chain messages to mint rsETH that was not backed by deposits.
LayerZero later attributed the intrusion to a sophisticated actor believed to be linked to North Korea’s Lazarus Group, saying internal RPC infrastructure used by its DVN had been compromised.
Evercrest’s account is different: it says the loss flowed from weaknesses in LayerZero’s own technology and from a failure to stop attackers from penetrating LayerZero-operated security systems.
In its public statement, KelpDAO said the exploit was “a direct result of LayerZero’s failures,” including inadequate disclosure of risks and a subsequent campaign of public blame.
The filing also cites more than $650 million in withdrawals after the incident, a 2,000 ETH contribution to restore rsETH backing, pressure on the KERNEL token, and extra forensic, legal, and migration costs.
After the attack, KelpDAO paused the affected bridges and later moved rsETH onto a different cross-chain standard.
Pellegrino rejected the lawsuit almost immediately.
In a post on X he confirmed that Evercrest had filed in British Columbia and called the claim “meritless,” adding that he would meet the plaintiffs in Vancouver and defend himself.
LayerZero has previously argued that a single-verifier configuration created a single point of failure and that applications should not rely on one DVN for high-value transfers.
The company later said it would no longer attest messages for 1-of-1 setups and that it should not have allowed its own DVN to serve as the sole verifier for large transactions.
Those later comments sit at the heart of the defamation allegations, which target public remarks by Pellegrino on X and Telegram.
No court has ruled on the allegations.
The case now turns on written guidance, default documentation, and who bore responsibility for a verifier that both sides agree was compromised. For DeFi, the dispute is larger than one protocol: it asks whether a messaging layer that reviews and signs off on a client’s configuration can later treat that same design as the client’s error after a catastrophic loss.
