Kelp DAO Parent Sues LayerZero Over $292 Million Bridge Exploit

Evercrest, the parent entity of Kelp DAO, has filed a civil claim in British Columbia against blockchain interoperability company LayerZero and its co-founder and CEO Bryan Pellegrino over the $292 million loss from a Kelp DAO bridge exploit in April. 

LayerZero has confirmed the filing, with Pellegrino calling the claims meritless and saying he plans to defend the case in Vancouver, where LayerZero is based.

Today we filed a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, to right the wrongs associated with the exploit of rsETH’s LayerZero bridge earlier this year. For more details, please refer to the statement below.https://t.co/gPQTPeM0Zh

— Kelp (@KelpDAO) September 25, 2026

The lawsuit follows a dispute over how the exploit happened and who should bear responsibility. Kelp DAO’s rsETH bridge, which was built using LayerZero, was drained of roughly 116,500 rsETH in April. LayerZero initially said its protocol had “functioned exactly as intended” and that the incident was limited to Kelp’s own configuration, but later apologized and acknowledged that its verifier should not have been the sole check for such a large transaction. Kelp subsequently moved its bridge to Chainlink’s CCIP in May.

Evercrest’s complaint alleges that LayerZero failed to disclose known risks in its technology and failed to prevent its own security setup from being compromised, despite reviewing and approving Kelp’s deployment and configuration. The case now puts the responsibility for the bridge failure, and the security checks surrounding it, before a court.

Also Read: South Korea Arrests 23 in Crypto Laundering Ring Linked to Cambodia Phishing Network

Why did the bridge hack come up with a lawsuit and not a rescue deal

When a cross-chain bridge is hacked, the usual response in crypto is for the company or person behind the project to replace users’ lost money instead of taking the dispute to court. When Wormhole lost $325 million in a 2022 hack, Jump Crypto, a company that supported the project, replaced the stolen money within days. Jump said the bridge was an important part of the crypto system and worth saving. The incident never turned into a court fight over who was responsible.

Multichain went the opposite direction and became a cautionary tale instead, after its CEO was arrested in China in 2023, roughly 1.5 billion dollars in user funds became stuck with no clear path to recovery, and the DAOs and protocols that lost money largely had no one left to sue or negotiate with. 

Kelp’s decision to file a formal claim in a Canadian court sits in the middle of those two outcomes, neither a quiet rescue deal nor a total loss with nowhere to turn, but an attempt to use the legal system to establish fault on the record, something the crypto industry has historically tried to avoid doing in public.

This hack was part of North Korea’s biggest month on record

LayerZero’s own investigation attributed the attack to North Korea’s Lazarus Group, and April 2026 turned out to be one of Lazarus’s most successful months ever, the group walked away with roughly 577 million dollars combined between the Kelp DAO bridge exploit and a separate breach of Drift Protocol the same month. 

Lazarus has stolen more than 6 billion dollars in crypto since 2017, and by mid 2026 it was responsible for over 70% of all crypto exploits recorded that year, with stolen funds typically laundered through THORChain, Russian exchanges, and Chinese over the counter trading desks before reaching North Korean state coffers, where US officials say the money helps fund the country’s weapons programs. 

That scale is part of why disputes like the one between Kelp and LayerZero are becoming more common industry wide, as more protocols get hit by the same well funded, repeat attacker, the argument over who should have caught the warning signs first is increasingly the fight that’s left once the money is already gone.

Users debate who should bear the blame for the exploit

The reaction is focused mainly on who should be held responsible, rather than whether depositors will get their money back. AOB pointed to the claim that LayerZero “reviewed and endorsed” Kelp’s setup in writing, arguing that this could make it harder for LayerZero to place all the blame on Kelp. At the same time, AOB noted that LayerZero’s terms of service could still make the case difficult for Kelp.

Manu made a different point, saying the $292 million loss has already been restored to depositors, with Aave completing the recovery in June. In his view, the court case is now about who bears the legal and reputational consequences, not whether users will be repaid.

Panda took a much stronger position, calling for LayerZero to pay and describing the project as a “scam.”

 

Enjoyed this? BookmarkDeFi Planet, explore related topics, and follow us onTwitter,LinkedIn,Facebook,Instagram,Threads, and CoinMarketCap Community for seamless access to high-quality industry insights

Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.

The post Kelp DAO Parent Sues LayerZero Over $292 Million Bridge Exploit appeared first on DeFi Planet.