Kelp DAO has initiated legal action against LayerZero and co-founder Bryan Pellegrino, holding the cross-chain protocol responsible for the April bridge exploit involving $292 million in rsETH.
The restaking project contends that LayerZero concealed vulnerabilities within its proprietary technology and failed to prevent malicious actors from breaching its security infrastructure.
Inside the $292 Million rsETH Exploit
The incident occurred on April 18, when attackers stole roughly 116,500 rsETH—Kelp DAO’s liquid restaking token—via the project’s LayerZero bridge. This breach stands as the biggest decentralized finance exploit of 2026. Afterward, LayerZero attributed the assault to the Lazarus-linked subgroup TraderTraitor.
According to LayerZero, the perpetrators hijacked a sufficient number of remote procedure call (RPC) nodes to supply fraudulent data to the bridge’s verifier. These specific servers function by relaying blockchain data to applications.
Consequently, the verifier authorized an rsETH burn that never actually took place, leading the Ethereum contract to release funds against it.
Conversely, LayerZero placed responsibility on Kelp’s configuration, noting that the bridge depended on a lone verifier managed by LayerZero Labs in a 1-of-1 setup.
The fallout cascaded swiftly. Within a 48-hour window, Aave saw its total value locked (TVL) decline by $8.45 billion, while decentralized finance TVL experienced a widespread contraction across leading blockchains.
Kelp DAO Sues LayerZero After Months of Blame
Kelp asserts that LayerZero and Pellegrino spent months shifting blame onto the project publicly. Meanwhile, the Kelp team maintains that LayerZero had reviewed and provided written approval for its deployment and configuration.
Having made the legal complaint publicly available, the protocol seeks to hold both LayerZero and Pellegrino responsible for the damage inflicted on Kelp and the broader decentralized finance ecosystem.
Furthermore, the team emphasized that user safety continues to be its primary focus. In the wake of the hack, Kelp has been transitioning the rsETH bridge to a heightened cross-chain security standard, having previously selected rival messaging system Chainlink CCIP as the substitute.
Efforts to reclaim the stolen assets have likewise reached the legal system. Back in May, a United States court directive prohibited Arbitrum DAO from transferring 30,766 ETH that had been frozen from the hacker.
Stating that it anticipates its day in court, Kelp DAO’s lawsuit against LayerZero could establish a precedent regarding the extent to which infrastructure providers bear liability for security breaches on client implementations.