KelpDAO sues LayerZero over $292M rsETH exploit

HACK OR EXPLOITKelpDAO sues LayerZeroover $292M rsETH exploit56IMPORTANCECLOSED14NEWS MEDIA14PIECESSep 25, 2026 04:10blockboard.net

Evercrest Technologies, which develops KelpDAO, filed a civil claim in British Columbia against LayerZero, its Canadian arm, and CEO Bryan Pellegrino over the April rsETH bridge exploit. The filing ties the case to 116,500 rsETH drained in the attack, which was worth about $292 million at the time, and says the bridge setup was approved in writing before the incident. Pellegrino has said he will defend the claims in Vancouver, and he has also called the lawsuit meritless.

What this rests on

Claim by claim, with its source
✓
LayerZero CEO Bryan Pellegrino said he will defend the claims in Vancouver.
✓
The lawsuit alleges security and disclosure failures and says LayerZero hid flaws in its own technology.
✓
Pellegrino has dismissed the lawsuit as meritless.
✓
KelpDAO says LayerZero endorsed the bridge setup in writing before the attack.
✓
Evercrest Technologies filed a civil claim in British Columbia against LayerZero, its Canadian arm, and CEO Bryan Pellegrino over the April rsETH bridge exploit.
✓
The notice of civil claim is dated Sept. 24, and Kelp published it late Thursday.
✓
Evercrest says LayerZero approved the single-verifier configuration in writing multiple times.
✓
The filing ties the case to the April 18 drain of 116,500 rsETH, valued at about $292 million at the time.

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

KelpDAO users and the wider DeFi sector are seeing a court fight rather than another round of public argument. The claim was filed in British Columbia, and it names LayerZero, its Canadian arm, and Bryan Pellegrino as defendants, so the dispute now sits in a court process that can surface new filings and testimony.

The practical change is that LayerZero’s bridge design and prior approvals are now part of a civil claim, not just a technical dispute around the April exploit. Before this filing, KelpDAO says LayerZero had endorsed the bridge setup in writing; now that same setup is being used as the basis for negligence and disclosure allegations in court.

What remains open is how the court will treat the written approvals, the single-verifier configuration, and the security and disclosure claims. The filings do not settle whether those approvals cover the disputed setup or whether the alleged flaws will be accepted as described, and that will depend on the record built in British Columbia.

Market reaction

ET Ethereum it is the asset of the company or protocol in the event from 2 h before to 4 h after the line marks the first headline
published
-0.51 % before publication
-0.03 % after
$2,676price at publication
13series points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 25 05:51
crypto.news scoop
Breaks the event: $292M
+26 min
Sep 25 06:17
Coinpedia context
Its angle: coinpedia, approving, reviewing
+1 h 58 m
Sep 25 07:49
+3 h
Sep 25 08:51
Cointelegraph echo
No new facts: dismissed, while; with quotes
+3 h 7 m
Sep 25 08:58
+3 h 22 m
Sep 25 09:13
The Block echo
Picks up what was published, with no new facts
+4 h 32 m
Sep 25 10:22
Unchained echo
No new facts: statements, inflicted, published; with quotes
+5 h 19 m
Sep 25 11:09
Decrypt echo
No new facts: different, multiple, warned; with quotes
+5 h 40 m
Sep 25 11:30
Crypto Briefing echo
No new facts: communication, transparent, highlights
+5 h 52 m
Sep 25 11:42
Crypto Economy echo
No new facts: d17ububixh, allegedly, connected; with quotes
+6 h 58 m
Sep 25 12:49
CR Cryptopolitan echo
No new facts: defendants, redundant, presented; with quotes
+7 h 10 m
Sep 25 13:00
+14 h 26 m
Sep 25 20:16
CR CryptoPotato echo
No new facts: straightforward, infiltration, accountable; with quotes
+1 d 13 h
Sep 26 19:30
NewsBTC echo
No new facts: approximately, allegations, connecting

Thefts of a similar size

WhenWhat happenedFigure
2.4 years ago DMM Bitcoin incident $305M
7 months ago Drift Trade · Proxy Upgrade Hijack incident $295M
6 months ago Kelp DAO incident $293M
2.7 years ago PlayDapp incident $290M
7 months ago Drift Protocol incident $285M

4197 incidents stored · 27 were as large as this one or larger ($292M)