KelpDAO has filed a lawsuit against LayerZero and the company's co-founder, Bryan Pellegrino, in an effort to establish accountability for a bridge exploit that drained roughly $292 million earlier this year. The protocol alleges that LayerZero failed to disclose significant technology risks prior to the incident and did not prevent an attack on its security infrastructure.

Attack Drained Approximately 116,500 rsETH

According to KelpDAO, the incident enabled attackers to exploit vulnerabilities in the bridge serving rsETH, KelpDAO's liquid restaking token, with the attackers reportedly stealing approximately 116,500 rsETH in the attack.

KelpDAO announced the legal action in a post on X on September 25, 2026:

Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH's LayerZero bridge earlier this year. For more details, please refer to the statement below.

— Kelp (@KelpDAO) September 25, 2026

The original post is available at x.com/KelpDAO.

Dispute Centers on 1-of-1 Verifier Setup

Central to the complaint is KelpDAO's claim that the bridge operated with a verifier configuration of 1-of-1 — a setup in which a single verifier signs off on messages crossing the bridge — which the protocol argues created a major security weakness by concentrating validation authority in a single point. KelpDAO further asserts that LayerZero reviewed and endorsed its deployment configuration in writing, making the question of whether LayerZero took responsibility for that configuration part of the lawsuit.

The filing follows months of public wrangling between the two parties. According to KelpDAO, LayerZero and Pellegrino "took the blame" for the issues arising from the exploit — a characterization the protocol refutes, stating that LayerZero was directly responsible for the security issues. KelpDAO is now calling on the court to decide who caused the ensuing damages.

LayerZero co-founder and CEO Bryan Pellegrino has rejected KelpDAO's allegations, describing the claims as "meritless" and saying LayerZero will defend itself.

elpDAO says the legal battle will be fought in Vancouver courts. The case could ultimately offer greater clarity on where responsibility for bridge security lies across the industry — a question that commonly arises when protocols rely on third-party bridge and messaging infrastructure.

KelpDAO Moves rsETH Bridge to New Security Standard

In the meantime, KelpDAO says it has already taken steps to enhance the protection of user assets. The protocol is transitioning the rsETH bridge to a "more secure cross-chain security standard" — a migration it frames as part of its response to the exploit — and states that the security of user assets is its top priority. The makeup of the new standard's verification setup is a detail to watch as the migration progresses, given that verifier configuration sits at the center of the legal dispute.

The lawsuit also seeks to establish a public record of the events surrounding the exploit. According to KelpDAO, its public complaint outlines the events and the allegations against LayerZero.

Broader Implications for Cross-Chain Bridges

The case is a reminder of the wider security issues surrounding cross-chain bridges in DeFi. These systems link blockchain networks together, but they can also introduce additional technical and verification risks. Bridge exploits have historically ranked among the costliest categories of security incidents in crypto, and how many independent parties must attest to cross-chain messages has been a recurring focus in bridge security debates.

The conflict likewise demonstrates the legal questions a bridge incident can raise beyond direct asset damage, as disagreements over security responsibilities can emerge between developers, infrastructure providers, and protocols.

KelpDAO has now brought its grievance before the legal system, and LayerZero is expected to challenge the claims as the case continues. The $292 million incident now involves both technical and legal disputes, and responsibility for the respective roles of the parties may be decided in court proceedings. Markers to watch include LayerZero's formal court response and the procedural path the case takes in Vancouver.

For KelpDAO, the lawsuit represents an attempt to hold LayerZero accountable for the exploit. For LayerZero, it is an opportunity to formally dispute the allegations. The case remains contested, and the court will hear arguments from both sides. Until a ruling is issued, KelpDAO's allegations should be regarded as claims to be tested in the courtroom rather than established findings.

Source: Live Bitcoin News