KelpDAO sues LayerZero for the largest exploit 2026 has seen so far

KelpDAO filed a civil claim against LayerZero and its co-founder Bryan Pellegrino, asserting that undisclosed vulnerabilities in the universal cross-chain bridge allowed an attacker to siphon 116,500 rsETH—worth about $292 million—on April 22. The protocol says LayerZero failed to disclose risks in its technology and did not prevent infiltration of its security infrastructure, which KelpDAO contends directly enabled the exploit. The April attack has been tied to a North Korean-affiliated hacking group and had spillover effects across DeFi markets. KelpDAO and external observers say the incident intensified pressure on stablecoin markets and liquidity, forcing Aave, the largest DeFi lending pool, to borrow $300 million to satisfy user withdrawals and contributing to a roughly $20 billion drop in total value locked. KelpDAO said it has since taken technical steps to protect users, including migrating rsETH’s bridge to what it called a more secure cross-chain security standard. The firm also said it sought to correct the public record and hold LayerZero and Pellegrino accountable for the damage to KelpDAO and the wider DeFi ecosystem. Pellegrino responded immediately after the filing, calling the claim meritless and announcing he will defend himself and LayerZero in British Columbia. KelpDAO is identified in the filing as Evercrest in Pellegrino’s public comments, and the case is slated to be addressed in a Vancouver court, according to his statement.