Kelp DAO Files Lawsuit Against LayerZero Over $292 Million Exploit

Kelp DAO has taken legal steps against LayerZero and its co-founder Bryan Pellegrino, attributing the responsibility for a significant exploit of its rsETH bridge to the cross-chain protocol. The lawsuit follows an incident in April where attackers drained approximately 116,500 rsETH, valued at $292 million, through vulnerabilities in LayerZero's technology.

The exploit, which has been described as the largest DeFi hack of 2026, involved attackers manipulating the bridge's verification process by compromising remote procedure call (RPC) nodes. LayerZero later identified the attackers as part of the Lazarus group, specifically the TraderTraitor subgroup, claiming that they fed false data to the bridge's verifier, leading to the unauthorized release of funds.

Kelp DAO contends that LayerZero had previously endorsed its bridge configuration and failed to prevent the attack, despite being aware of potential vulnerabilities. The complaint highlights that LayerZero's single-verifier setup, operated by LayerZero Labs, was a critical factor in the exploit. Following the incident, Kelp DAO has shifted its bridge to a more secure cross-chain standard, specifically naming Chainlink CCIP as a replacement.

The lawsuit also seeks to address the broader implications of accountability in the DeFi ecosystem, as Kelp DAO aims to hold LayerZero responsible for the damages incurred. The fallout from the exploit has reportedly led to significant declines in total value locked across various DeFi platforms, further emphasizing the impact of security breaches in the space.

As Kelp DAO pursues this legal battle, the case may serve as a pivotal test for the responsibilities of infrastructure providers in safeguarding client deployments against exploits.