Kelp DAO sues LayerZero and Bryan Pellegrino over $292 million exploit

Kelp DAO sued LayerZero and co-founder Bryan Pellegrino over a $292 million rsETH bridge exploit. Kelp claims LayerZero approved its bridge configuration in writing. Kelp argues that LayerZero hid flaws in its technology. Kelp also claims that LayerZero failed to stop attackers from infiltrating its security systems. Attackers drained about 116,500 rsETH through the LayerZero bridge on April 18. The theft became the largest DeFi exploit of 2026. LayerZero later linked the attack to the Lazarus subgroup TraderTraitor. LayerZero said the attackers took over enough remote procedure call nodes to feed false data to the bridge verifier. The verifier approved an rsETH burn that never happened. The Ethereum contract then released funds against the false burn. LayerZero pointed to Kelp's setup. The bridge used a 1-of-1 verifier operated by LayerZero Labs. Aave's total value locked fell $8.45 billion within two days. DeFi total value locked also fell broadly across major chains. Kelp says LayerZero and Pellegrino spent months publicly blaming the protocol. Kelp says LayerZero reviewed and endorsed its deployment and configuration in writing. Kelp published the complaint. Kelp wants LayerZero and Pellegrino held accountable for harm to Kelp and the wider DeFi ecosystem. Kelp says it has been moving rsETH's bridge to a more secure cross-chain standard since the hack. Kelp previously named Chainlink CCIP as the replacement. A US court order in May blocked Arbitrum DAO from moving 30,766 ETH that it had frozen from the hacker. Kelp says it looks forward to a court hearing.