# KelpDAO takes LayerZero to court over $292M rsETH exploit Author: KriptoMeta Editorial Team Language: English Published: 2026-09-28T16:47:57+03:00 Updated: 2026-09-28T16:47:57+03:00 ![A disconnected glass data bridge between documents labeled KelpDAO and LayerZero.](https://kriptometa.com/uploads/kelpdao-milyon-dolarlik-saldiriyi-mahkemeye-tasidi-3230_article.webp) ## Key takeaways - KelpDAO developer Evercrest named LayerZero entities and CEO Bryan Pellegrino in a civil claim dated September 24. - The dispute concerns the April 18 exploit that released 116,500 rsETH, valued at approximately $292 million at the time. - The parties disagree over responsibility for the single-verifier setup. The allegations in the filing are not a court ruling. The dispute over April’s rsETH exploit has reached Vancouver. KelpDAO alleges that LayerZero approved its bridge configuration, while the other side calls the claim meritless. The dispute between [DeFi](https://kriptometa.com/en/glossary/defi) project KelpDAO and LayerZero over the rsETH exploit has reached court. KelpDAO developer Evercrest Technologies named two LayerZero entities and CEO Bryan Pellegrino as defendants in a [civil claim dated September 24](https://drive.google.com/file/d/1fVSd7z0fF48bOiRB3EpmmVYi4omNY3iI/view?usp=sharing), filed in the Vancouver registry of the Supreme Court of British Columbia. The filing alleges negligent misrepresentation and negligence concerning the bridge’s security setup, alongside defamation. The exploit occurred on April 18. According to the claim, 116,500 rsETH was released from the bridge on Ethereum without a corresponding locking transaction on the other chain. The assets were worth approximately $292 million at the time. rsETH is Kelp’s liquid restaking token; it is [distinct from Ether itself](https://kriptometa.com/en/glossary/ethereum-ether). ## Who approved the single-verifier setup? In its [statement announcing the lawsuit](https://x.com/KelpDAO/status/2103332910128599327), KelpDAO alleged that LayerZero reviewed and endorsed the deployment in writing. The filing makes a related argument: Kelp says it was directed toward a single-verifier configuration without adequate warnings about the risks. LayerZero gives a different account. Its [April 19 incident statement](https://layerzero.network/blog/kelpdao-incident-statement) said Kelp relied solely on the LayerZero Labs verifier network, contrary to its advice to use multiple verifiers. In a [subsequent statement on May 8](https://layerzero.network/blog/an-overdue-apology), however, LayerZero acknowledged that allowing its DVN to act as the sole verifier for high-value transactions was a mistake. It also said the LayerZero Labs DVN no longer serviced 1-of-1 configurations. Pellegrino nevertheless rejected the September lawsuit, saying on X that he would defend himself in Vancouver: > “The claim continues to be meritless.” Bryan Pellegrino, LayerZero CEO — written response to the lawsuit [Bryan Pellegrino’s response to the civil claim](https://x.com/PrimordialAA/status/2103257436048310471) DVNs, the networks at the center of the technical dispute, verify messages moving between blockchains. In Kelp’s 1-of-1 configuration, approval from a single network was sufficient. LayerZero’s incident account describes an attacker manipulating the RPC systems that supplied data, making a transaction that never happened appear confirmed. Requiring approval from an additional independent verifier reduces dependence on one source. The legal dispute concerns whose knowledge and guidance informed the choice of configuration. ## $292 million is not a damages award **What the figure represents matters.** The $292 million refers to the approximate value of assets at the time of the exploit, as stated in the claim. It is not a court-ordered payment. Evercrest seeks damages under several headings, but the relief section does not state a single total amount. KelpDAO also said it was migrating the rsETH bridge to another cross-chain standard. That statement does not establish that the migration has finished or that users have been repaid. The staking mechanism behind a token and the bridge moving it between chains are separate layers. Our [comparison of liquid and direct staking risks](https://kriptometa.com/en/liquid-vs-solo-staking) explains why additional contracts matter. For this [crypto security case](https://kriptometa.com/en/news/security), the next substantive issue is how communications about the deployment and risk warnings will be assessed. The public record currently consists of Kelp’s detailed allegations and LayerZero’s competing account, rather than a court decision establishing responsibility.