KelpDAO Files Civil Lawsuit Against LayerZero Over $292 Million Exploit

This case highlights critical vulnerabilities in decentralized finance infrastructure and the accountability of technology providers.

• KelpDAO filed a civil claim against LayerZero entities and co-founder Bryan Pellegrino on September 25, 2026, alleging negligence and defamation.
• The claim stems from an exploit on April 18, 2026, that drained 116,500 rsETH, valued at approximately $292 million, from a LayerZero-powered bridge.
• LayerZero attributed the loss to KelpDAO's setup choices, while KelpDAO asserts that LayerZero endorsed their configuration.

• The exploit occurred due to a social engineering attack that compromised a LayerZero developer's system, allowing attackers to forge messages.
• KelpDAO paused its bridges within an hour of the exploit, but public disagreements ensued regarding responsibility for the loss.
• LayerZero has since stopped supporting single-verifier configurations, directing applications toward more secure multi-verifier setups.

The civil claim filed by KelpDAO against LayerZero is a significant development in the decentralized finance (DeFi) landscape, particularly concerning accountability and risk management in blockchain technology. The exploit that drained 116,500 rsETH from KelpDAO's bridge infrastructure was not merely a technical failure; it was a culmination of systemic vulnerabilities inherent in the cross-chain messaging protocols that underpin many DeFi applications today.

On April 18, 2026, attackers executed a sophisticated social engineering scheme that compromised a LayerZero developer's system. This breach allowed them to send forged messages through a single decentralized verifier network (DVN), leading to the unbacked minting of a substantial amount of rsETH on the destination chain. The incident raised immediate concerns about the security of LayerZero's technology and the adequacy of its risk management practices.

In the aftermath, KelpDAO's response was swift; they paused their bridges to prevent further losses. However, the public fallout revealed a rift between KelpDAO and LayerZero. KelpDAO claims that LayerZero had previously endorsed their single-verifier setup, while LayerZero contended that the exploit was a direct result of KelpDAO's choices. This disagreement over responsibility is at the heart of the civil claim, which alleges negligence, negligent misrepresentation, and defamation.

LayerZero's co-founder, Bryan Pellegrino, has publicly dismissed the claim as meritless, indicating that the company will vigorously defend itself in court. This legal battle could set a precedent for how liability is determined in the DeFi space, particularly regarding the responsibilities of technology providers versus their clients.

Moreover, the incident has prompted LayerZero to revise its support policies, ending the endorsement of single-verifier configurations and pushing affected applications toward multi-verifier setups. This shift reflects a broader industry trend toward enhancing security measures in response to increasing exploit risks.

As KelpDAO has migrated its rsETH transfers to Chainlink's Cross-Chain Interoperability Protocol (CCIP), the implications of this lawsuit extend beyond the immediate parties involved. It raises critical questions about the future of cross-chain technology, the standards of security that developers must adhere to, and the potential for regulatory scrutiny in the DeFi sector.

• DeFi Developers: Increased scrutiny on security practices may lead to more stringent development protocols.
• Investors: Heightened risk awareness could affect investment decisions in DeFi projects.
• Regulatory Bodies: Potential for new regulations aimed at improving accountability in blockchain technology.

• Court Proceedings: The outcome of the civil claim could set a legal precedent for liability in DeFi.
• LayerZero's Policy Changes: Watch for further adjustments in LayerZero's support structures and security measures.
• Market Reactions: Monitor how this lawsuit impacts investor confidence and the broader DeFi market.