KelpDAO Developer Evercrest Sues LayerZero and CEO Bryan Pellegrino Over $292 Million rsETH Bridge Exploit
Key Takeaways
- •Evercrest Technologies, the developer behind KelpDAO, filed a lawsuit on Sept. 24 against LayerZero Labs, its Canadian entity, and co-founder and CEO Bryan Pellegrino over the rsETH bridge exploit that caused approximately $292 million in losses.
- •The complaint attributes the exploit to poisoned RPC data, a compromised LayerZero developer machine accessed in March 2026, and a 1-of-1 DVN configuration, which allegedly led to a false attestation that 116,500 rsETH had been locked on Unichain and enabled the unauthorized minting on Ethereum.
- •Evercrest says it detected the attack within an hour, suspended its LayerZero bridges, froze the attacker's wallet, and stopped a second attempted mint of 40,000 rsETH.
- •According to the filing, LayerZero reviewed and endorsed KelpDAO's bridge configuration and instructed the 1-of-1 DVN setup, while LayerZero and Pellegrino have since blamed the single-verifier configuration for the incident.
- •Evercrest is seeking damages including a 2,000 ETH recapitalization, more than $650 million in user withdrawals, lost fee revenue, declines in the KERNEL token, costs from the sbUSD vault shutdown, and a delayed stablecoin product.
Evercrest Technologies, the development firm behind KelpDAO, has filed a lawsuit against LayerZero Labs, its Canadian entity, and co-founder and CEO Bryan Pellegrino over an exploit of the protocol's rsETH bridge that caused roughly $292 million in losses, escalating a dispute over who was responsible for the incident.
As a civil complaint, Evercrest's filing presents the developer's account of the exploit and its claimed damages; the allegations and liability claims remain subject to the legal process.
In a complaint published on Sept. 24, Evercrest argues that the exploit, which came to light on April 18, did not stem from a vulnerability in KelpDAO's own contracts. Instead, the developer attributes the incident to a combination of poisoned RPC data, a compromised developer device, and a 1-of-1 LayerZero DVN configuration, a setup in which a single designated verifier attests to cross-chain messages.
Kelp announced the filing on X on Sept. 25:
Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH's LayerZero bridge earlier this year. For more details, please refer to the statement below.
— Kelp (@KelpDAO) September 25, 2026
Source: Kelp (@KelpDAO) on X
According to the filing, an attacker compromised a LayerZero developer's machine on March 6, 2026, before turning to the RPC infrastructure used by LayerZero's Decentralized Verifier Network (DVN) in April. The manipulated RPC data allegedly led LayerZero's DVN to confirm that 116,500 rsETH had been locked on Unichain, even though no actual lock ever took place.
With LayerZero acting as the sole verifier for the Unichain bridge, that false attestation allegedly resulted in the minting of $292 million in rsETH on Ethereum. Evercrest says it identified the attack within an hour, suspended its LayerZero bridges, froze the attacker's wallet, and stopped a second attempted mint of 40,000 rsETH.
The complaint also challenges LayerZero's public account of the incident. Evercrest claims LayerZero had reviewed and endorsed KelpDAO's bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup. According to the filing, LayerZero subsequently blamed KelpDAO's single-verifier configuration, and Pellegrino said applications should not rely on a sole DVN. Evercrest maintains that it followed LayerZero's written instructions.
Evercrest is seeking damages covering a 2,000 ETH recapitalization, more than $650 million in user withdrawals, lost fee revenue, declines in the KERNEL token, the shutdown of KelpDAO's sbUSD vault, a delayed stablecoin product, legal and migration costs, and reputational harm.
