Skip to content
Today
Sections

Invest Reports disagree4 publishers 3 min read Published

KelpDAO's developer sues LayerZero over the lone-verifier setup behind the $292 million rsETH exploit

Evercrest, the company behind KelpDAO, is suing LayerZero and CEO Bryan Pellegrino in British Columbia over the $292 million rsETH bridge exploit. Its negligence case rests on written 2024 assurances about a single verifier and on a risk warning it says LayerZero gave another customer.

The Investor · Invest desk

Send a correction

What happened

  • Evercrest Technologies, the company behind KelpDAO, sued LayerZero Labs, its Canadian arm and co-founder Bryan Pellegrino in British Columbia for negligent misrepresentation, negligence and defamation.
  • The April 18 exploit took 116,500 rsETH, worth about $292 million, from a bridge where LayerZero's own verifier was the only one required to approve a mint.
  • Evercrest alleges LayerZero told it in February 2024 that the default setting presented no problem, then told it in March 2024 to clone another bridge's 1-of-1 setup.
  • Pellegrino wrote that the claim "continues to be meritless" and said he would meet Evercrest in Vancouver to defend himself.

Why it matters

  • What it costs cost Kelp's outflows are larger than the theft: more than $650 million withdrawn since April is about 2.2 times the value taken, and Evercrest is claiming that larger sum from LayerZero.
  • Who's exposed exposure Cryptopolitan put 47% of active LayerZero app contracts on 1-of-1 at the time of the exploit, so any written sign-offs LayerZero gave those teams would support the same kind of claim.
  • What doesn't add up contradiction LayerZero blamed Kelp for leaving a multi-DVN model it had "consistently recommended to all integration partners," yet the filing says LayerZero later admitted it "made a mistake" letting its DVN act as a 1-of-1.
  • What it sets up precedent A finding for Evercrest on the USDT0 warning would oblige a vendor that advises many integrators to give each of them the same risk notice.

Since April, Kelp has spent its money on repairs and replacement. Its damages list includes a 2,000 ETH contribution to restore rsETH's backing [5], about 1.7% of the unbacked tokens by count [18]. It has shut down its planned sbUSD stablecoin and picked Chainlink's CCIP to carry rsETH in LayerZero's place [6]. According to the filing, the fall in the KERNEL token drew warnings from regulators and exchanges [5].

Cointelegraph describes the months-long fight as a question of whether the loss came from LayerZero's compromised infrastructure, Kelp's bridge configuration, or both [16]. The filing starts with the first. On Evercrest's account, malware went onto a LayerZero developer's computer on March 6, and the attacker then tampered with LayerZero's nodes so they fed false readings to its verifier [4]. On April 18 the attacker disabled the third-party nodes the verifier also used, and the verifier was told 116,500 rsETH had been locked on Unichain when nothing had [4]. That puts 43 days between the malware and the mint [13]. The filing quotes LayerZero's January 2025 pitch, which said a compromised verifier could at most "fail to verify a message correctly" [20]. This one approved a false message, and tokens worth about $2,506 apiece at the time were minted against it [12].

LayerZero's final incident report accepts that its internal nodes were compromised. It argues the forged message cleared only because Kelp's bridge relied on a single DVN as its only verification path [21]. Pellegrino said in May that Kelp's account was "completely untrue," and that Kelp had launched on LayerZero's multi-DVN default and switched to 1-of-1 itself [7]. Kelp, for its part, wrote that it needs to "correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem" [15].

In my view the allegation with the most reach is a different one. According to the filing, LayerZero warned the developer of USDT0 about the risks of default verifier setups in late 2024 or early 2025, and that developer went on to run its own verifier [9]. Evercrest says Kelp got no comparable warning [9]. This allegation matters whichever side flipped Kelp's setting. It goes to what LayerZero knew before April and which customers it told.

If the court treats LayerZero's 2024 messages as advice Kelp was entitled to rely on, configuration risk moves toward the vendor. If it accepts Pellegrino's version [7], the risk stays with the customer, where LayerZero's report puts it [21]. A settlement would leave neither answer on the record. I'd expect the USDT0 allegation to decide how far the negligence count gets. That view fails if LayerZero produces a warning sent to Kelp like the one USDT0 received. None of the allegations has been tested in court, and no response has been filed [11]. So far, Kelp's own move to CCIP is the only change of vendor the record shows [6].

What to watch

  • LayerZero's response to the notice of civil claim, and whether it disputes the February and March 2024 messages or the USDT0 warning.
  • Whether other teams from LayerZero's former 1-of-1 integrations disclose similar written sign-offs or file claims of their own.
  • Completion of Kelp's rsETH migration to Chainlink's CCIP, and whether withdrawals keep running after the move.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption40
Hype gap+15
Incentives70
Confidence60

Perspective Coverage

4 publishers
Builder
Builder 40%
Operator
Operator 32%
Investor
Investor 28%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Evercrest Technologies, the company behind KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia naming LayerZero Labs Ltd., LayerZero Labs Canada Inc. and co-founder Bryan Pellegrino, pleading negligent misrepresentation, negligence and defamation and seeking aggravated and punitive damages.

    Reported SupportedView cited source
  2. [2]

    Pellegrino is sued personally over posts on Telegram and X.

    Reported SupportedView cited source
  3. [3]

    The April 18 heist took 116,500 rsETH, worth about $292 million at the time; Kelp's bridge used a 1-of-1 DVN in which LayerZero's own verifier was the only one needed to sign off before rsETH locked on one chain could be minted on another.

    Reported SupportedView cited source
  4. [4]

    According to the claim, an attacker put malware on a LayerZero developer's computer on March 6, then tampered with LayerZero's nodes so they fed false readings to its verifier; on April 18 the attacker disabled the third-party nodes the verifier also used, so it was told 116,500 rsETH had been locked on Unichain when nothing had, and with one verifier required the tokens were minted unbacked.

    Reported SupportedView cited source
  5. [5]

    Evercrest claims damages including a 2,000 ETH contribution to restore rsETH's backing, more than $650 million withdrawn since the exploit, and a fall in the KERNEL token that drew regulator and exchange warnings.

    Reported SupportedView cited source
  6. [6]

    The filing says Kelp shut down its planned sbUSD stablecoin after the attack and is moving rsETH to another cross-chain security standard; Kelp selected Chainlink's CCIP in May.

    Reported SupportedView cited source
  7. [7]

    Pellegrino said in May that Kelp's account was "completely untrue" and that Kelp was launched on LayerZero's multi-DVN default and converted to 1-of-1 itself.

    Reported SupportedView cited source
  8. [8]

    Pellegrino tweeted that the claim "continues to be meritless" and that he would meet Evercrest in Vancouver to defend himself.

    Reported SupportedView cited source
  9. [9]

    The filing says LayerZero warned a separate developer, USDT0, about risks in its default verifier configurations in late 2024 or early 2025, prompting that developer to run its own verifier; Evercrest says it received no comparable warning.

    Reported SupportedView cited source
  10. [10]

    Cryptopolitan reported that 47% of active LayerZero app contracts were running 1-of-1 setups at the time of the exploit, a setup LayerZero has since banned.

    Reported Supported Source: CryptopolitanView cited source
  11. [11]

    None of the allegations has been tested in court, and no response to the claim has been filed.

    Reported SupportedView cited source
  12. [12]

    The exploit valued each rsETH at about $2,506 at the time.

    Derived Supported
  13. [13]

    Evercrest's timeline puts 43 days between the malware on March 6 and the forged mint on April 18.

    Derived Supported
  14. [14]

    According to the filing, days after the incident statement LayerZero admitted it had "made a mistake by allowing [its] DVN to act as a 1-of-1 DVN for high-value transactions."

    Reported Supported Source: Evercrest's filing, as reported by DecryptView cited source
  15. [15]

    "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem," Kelp wrote.

    Reported SupportedView cited source
  16. [16]

    The lawsuit escalates a months-long dispute over whether the loss was caused by the compromise of LayerZero's infrastructure, KelpDAO's bridge configuration, or both.

    Reported SupportedView cited source
  17. [17]

    Withdrawals of more than $650 million since the exploit are about 2.2 times the roughly $292 million taken.

    Derived Supported
  18. [18]

    The 2,000 ETH contribution equals about 1.7% of the 116,500 unbacked rsETH by token count.

    Derived Supported
  19. [19]

    Evercrest alleges LayerZero told it on Feb. 2, 2024, that the default setting presented "no problem," and on March 21, 2024, told Evercrest to clone the 1-of-1 setup of another bridge.

    Reported ContestedView cited source
  20. [20]

    LayerZero's pitch, dated Jan. 2025 in the filing, described a redundant and monitored verifier network where a compromised verifier could at most "fail to verify a message correctly."

    Reported ContestedView cited source
  21. [21]

    LayerZero's final incident report said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message, and argued the loss was possible because Kelp's bridge relied on a single LayerZero DVN as its only verification path; LayerZero said it had recommended multiple DVNs and subsequently stopped acting as sole required verifier.

    Reported ContestedView cited source
  22. [22]

    LayerZero's incident statement said the single-verifier setup contradicted a multi-DVN model it had "consistently recommended to all integration partners."

    Reported ContestedView cited source

Sources

4 independent publishers whose own reporting we read for this story.

  1. cointelegraph.com

    1 article · September 25, 2026

    KelpDAO sues LayerZero, CEO over $292M rsETH bridge exploit
  2. cryptobriefing.com

    1 article · September 25, 2026

    KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting
  3. cryptopolitan.com

    1 article · September 25, 2026

    KelpDAO's developer takes LayerZero to court in Canada over the $292 million rsETH exploit
  4. decrypt.co

    1 article · September 25, 2026

    KelpDAO Developer Sues LayerZero Over $292M Bridge Exploit

Topics and entities

Topics

Entities