KelpDAO LayerZero Lawsuit Targets CEO Over $292M Hack

Pellegrino said Kelp filed the notice of civil claim on Thursday. Kelp confirmed it publicly early Friday. The filing names LayerZero as a corporate defendant and Pellegrino as an individual. Trial is expected in Vancouver.

What the KelpDAO LayerZero Lawsuit Alleges

Kelp frames the April exploit as the direct result of LayerZero’s own failures. In a public statement, the team said LayerZero failed to disclose weaknesses in its technology.

Kelp also alleges that attackers infiltrated LayerZero’s own security infrastructure. According to the team, that breach let the attackers exploit those weaknesses.

The third claim is the sharpest. Kelp says LayerZero reviewed and endorsed its deployment in writing. Then LayerZero publicly blamed Kelp after the funds vanished. You can read Kelp’s full statement on X.

Importantly, no public court document with an action number has surfaced yet. So the exact legal counts stay unconfirmed. The precise damages figure is also unknown. The $292 million number is the exploit loss, not a stated demand. News outlets including crypto.news reported the same caveat.

How the rsETH Bridge Exploit Worked

The loss traces back to 18 April 2026. On that day, attackers drained 116,500 rsETH from the Ethereum adapter. It happened in a single transaction worth about $292 million.

The root cause was not a bug in the rsETH token. Instead, attackers poisoned LayerZero’s view of Unichain state. They did so through compromised internal servers.

As a result, LayerZero’s verifier attested a cross-chain message that Unichain never sent. The forged packet carried nonce 308. Yet the real source nonce still sat at 307, per on-chain records.

Because that route required only one verifier, Ethereum treated the message as final. It then released the escrowed rsETH. Kelp’s multisig froze the contracts about 46 minutes later. That pause blocked a second forged packet worth roughly $95 million.

Investigators later tied the attack to North Korea’s Lazarus group. LayerZero, Mandiant, and CrowdStrike all pointed to the TraderTraitor unit. That link remains an attribution, not a court finding.

The Damage Spread Beyond the Bridge

The stolen rsETH stayed a transferable token. So the attacker posted it as collateral on lending markets before they froze.

Aave took the hardest hit downstream. The attacker used about 89,567 rsETH across eight positions. From there they borrowed tens of thousands of ETH and wstETH.

Bad-debt estimates ranged from $177 million to $230 million on Aave alone. Separately, the Arbitrum Security Council froze about 30,766 ETH of downstream funds. These figures sit apart from the original $292 million drain.

An industry recovery effort later refilled the drained adapter. Kelp also moved its bridging to Chainlink CCIP, per The Block.

Five Months of Public Blame

The two sides have argued since the day after the drain. On 19 April, LayerZero called the incident “isolated to KelpDAO’s rsETH configuration.” It blamed the single-verifier setup in its incident statement.

Pellegrino later said Kelp started with a multi-verifier setup. Then it manually switched to a one-of-one design in April 2024. Kelp counters that the setup matched LayerZero’s own documentation.

Then the framing shifted again. In May, LayerZero admitted fault for servicing that risky setup. “We made a mistake by allowing our DVN to act as a 1/1 DVN,” the firm said, per CoinDesk.

Still, that apology owned the configuration decision. It did not concede the full loss. The blame fight then simmered for months before the suit.

Pellegrino Calls the Claim Meritless

Pellegrino responded quickly and directly. “Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ,” he wrote on X.

He added that the claim “continues to be meritless.” He also said he will defend himself in Vancouver. LayerZero Labs keeps a Vancouver presence, which explains the venue.

The core legal question is genuinely contested. Analysts ask whether a messaging provider can be liable here. After all, the app itself set the verifier threshold to one.

Kelp argues the provider ran the only verifier. It also let its own servers stay compromised for weeks. LayerZero argues the customer chose an insecure setup against clear guidance.

Muted Market Reaction So Far

Despite the $292 million headline, ZRO is not crashing on the filing. The token traded between roughly $1.46 and $1.54 on 25 September, according to OKX data.

That relative calm reflects context. ZRO was already volatile from a 32.6 million token unlock on 20 September. So the suit adds little fresh pressure.

On the other side, rsETH backing looks stable. Kelp reported more than 100% ETH backing after the mid-May refill. No fresh depeg appeared around the filing.

The next milestone is service and LayerZero’s formal response. That could take weeks under British Columbia rules. Until a court document surfaces, treat the specific counts as alleged, not proven. This article is informational only and not financial advice.