KelpDAO Tells Court LayerZero Said "Good," "No Problem" — Then Blamed The Bridge 🍵

KelpDAO has sued cross-chain protocol LayerZero and its co-founder and CEO Bryan Pellegrino in connection with the roughly $292 million exploit of its rsETH bridge, alleging LayerZero endorsed in writing the configuration it later faulted for the loss. The notice of civil claim was filed by Evercrest Technologies, the developer behind KelpDAO, in the Supreme Court of British Columbia and names LayerZero Labs Ltd., LayerZero Labs Canada Inc. and Pellegrino personally over posts on Telegram and X. It pleads negligent misrepresentation, negligence and defamation, and seeks aggravated and punitive damages.

The filing details communications it says show LayerZero reviewed and approved the bridge setup. According to the claim, LayerZero told KelpDAO in February 2024 that its draft code was "good" and that there was "[n]o problem" using the default configuration, and in March 2024 explicitly directed it to run a 1-of-1 setup using LayerZero's own verifier network. In January 2025, LayerZero said that even if a verifier were compromised the worst it could do was fail to verify a message correctly. Evercrest says LayerZero separately warned another developer, USDT0, about risks in its default verifier configurations in late 2024 or early 2025, prompting that developer to operate its own, and that KelpDAO received no comparable warning.

KelpDAO said Friday that LayerZero failed to disclose risks in its technology or prevent attackers from compromising its infrastructure, and that the dispute had continued since April. "Our number one priority has always been and will remain the security of our users' assets," Kelp wrote. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem." Pellegrino called the claim "meritless" and said he would defend the case in Vancouver. Cointelegraph contacted LayerZero for further comment but did not receive a response before publication.

The April 18 attack drained 116,500 rsETH, then worth about $292 million, from the bridge. The claim says the breach began on March 6 when an attacker installed malware on a LayerZero developer's computer, then tampered with LayerZero's nodes so they fed false readings to its verifier. On April 18 the attacker disabled the third-party nodes the verifier also relied on, so the system was told the rsETH had been locked on Unichain when nothing had been, and the tokens were minted unbacked; Evercrest says it paused the bridges within roughly an hour and blocked a second attempt.

LayerZero, in its final incident report, said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message, and argued the loss was possible because the bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path. Its incident statement said the single-verifier setup contradicted a multi-DVN model it had "consistently recommended to all integration partners," and Pellegrino wrote that "[n]obody should be relying on sole DVN." Days later, LayerZero admitted it had "made a mistake by allowing [its] DVN to act as a 1-of-1 DVN for high-value transactions." KelpDAO has said its DVN configuration had previously been discussed with LayerZero and "confirmed as secure," and announced plans to migrate the rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol.