KelpDAO Sues LayerZero and CEO Bryan Pellegrino Over the $292M rsETH Hack

The blame game between KelpDAO and LayerZero just left X and walked into a British Columbia courtroom.

On September 24, Evercrest Technologies, the company behind the liquid restaking protocol KelpDAO, filed a civil claim in the Supreme Court of British Columbia against LayerZero Labs Ltd., its Canadian arm, and co-founder and CEO Bryan Pellegrino, named personally. The case sits at the Vancouver Law Courts under file number 267169. It pleads negligent misrepresentation, negligence, and defamation, and asks for aggravated and punitive damages on top of whatever compensatory number comes out of it.

Kelp broke the news itself:

"Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH's LayerZero bridge earlier this year. Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures. But the record is straightforward: LayerZero reviewed and endorsed — in writing — our deployment and configuration of LayerZero's technology."

Pellegrino didn't wait long to fire back. His reply landed on X before most outlets had even finished writing up Kelp's statement:

"Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ. The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly."

Two sides, two very different stories about the same paper trail. That's basically the whole lawsuit in one sentence.

How we got here?

Rewind to April 18. An attacker drained 116,500 rsETH — about $292 million at the time, from KelpDAO's cross-chain bridge, which ran on LayerZero's messaging stack. It's still one of the year's ugliest DeFi hacks, and the fallout wasn't just the stolen funds: Evercrest says Kelp users have pulled more than $650 million out of the protocol since.

The filing pushes the real starting point back further than April 18, though. It says the intrusion began six weeks earlier, on March 6, when an attacker used social engineering to drop malware on a LayerZero developer's machine and quietly tampered with LayerZero's internal nodes from there. By the time a forged message finally moved, KelpDAO's bridge waved it through, because the rsETH deployment ran on a 1-of-1 decentralized verifier network, with LayerZero as the one and only verifier. No second signature to catch a fake.

That single detail is basically the entire fight. LayerZero's own post-hack statement put it bluntly: the setup, LayerZero wrote, "directly contradicts the multi-DVN redundancy model that LayerZero has consistently recommended to all integration partners" — and KelpDAO, in LayerZero's telling, went with the risky 1-of-1 setup anyway, against advice.

Evercrest tells it the other way around. The claim alleges LayerZero reviewed and signed off on that exact configuration in writing — first telling Kelp back in February 2024 that the default single-verifier setup was "no problem," then steering it toward another protocol's single-verifier arrangement the following month. If Evercrest can back that up with the actual correspondence, LayerZero's "you were warned" framing starts looking a lot more like the defamation claim it's built into.

Worth noting: LayerZero didn't hold its original line for long. Within weeks it walked part of it back, issuing what The Defiant called an "overdue apology" and admitting it was a mistake to let its own DVN act as sole verifier on high-value transfers — while also revealing that Lazarus Group had poisoned its internal RPC infrastructure and hit an external provider with a DDoS around the same window. Investigators, LayerZero included, point to TraderTraitor, the North Korea-linked unit inside Lazarus.

By May, Kelp had clearly stopped waiting for that story to settle. It announced it was moving rsETH over to Chainlink's Cross-Chain Interoperability Protocol, saying flatly that LayerZero had "blamed users for an issue caused by their own infrastructure failure." The sbUSD stablecoin Kelp had been building got shelved in the process.

What Evercrest Is Actually Asking For?

Beyond the negligence and defamation damages, Decrypt reported the claim also seeks a contribution of roughly 2,000 ETH toward rebuilding rsETH's backing — money on top of whatever a court awards for the reputational and financial harm Evercrest says it suffered.

Under BC's civil rules, LayerZero and Pellegrino have 21 days to respond once served in Canada, or 35 days if served abroad. None of this has been tested in front of a judge yet, and LayerZero still maintains the single-verifier setup was Kelp's own call to make. Pellegrino, for his part, keeps calling the suit baseless and says he's not interested in settling.

Read the two accounts side by side and there's no obvious middle ground — LayerZero says it warned Kelp, Kelp says LayerZero signed off in writing. A Vancouver court is going to have to pick one, and whichever way it goes, expect every bridge protocol's DVN documentation to get a lot more careful right after.