KelpDAO filed a formal court filing for negligence on September 25, 2026, against LayerZero and CEO Bryan Pellegrino. The lawsuit seeks compensation for a loss of 292 million dollars resulting from the security exploit of its rsETH bridge.
The legal action alleges that structural security vulnerabilities within LayerZero infrastructure contributed to the incident. According to the complaint, LayerZero failed to disclose known technological risks and previously endorsed the bridge configuration in writing before malicious actors drained the platform contracts.
The lawsuit directly names Bryan Pellegrino alongside LayerZero Labs. KelpDAO asserts that executive representations concerning protocol reliability misled developers into assuming the cross-chain architecture met rigorous standards of institutional resilience.
The litigation comes as tracing efforts continue regarding the laundering of stolen funds across decentralized venues. KelpDAO aims to hold cross-chain infrastructure providers legally accountable for operational damages affecting depositors and the broader ecosystem.
Technical dispute surrounding bridge verification
The underlying exploit occurred on April 18, 2026, when attackers managed to steal 116,500 rsETH from the cross-chain contract. At market prices during the attack, the drained assets carried a total valuation of approximately 292 million dollars.
— Kelp (@KelpDAO) September 25, 2026
In an official statement from KelpDAO, the developers reiterated that protecting depositor assets remains their fundamental objective. The protocol stated that legal proceedings are necessary to correct public records and ensure LayerZero answers for documented infrastructure failures.
LayerZero explained in its incident summary that attackers compromised internal nodes, forcing its verifier to validate a forged cross-chain payload. The company argued that the exploit occurred because KelpDAO configured a single decentralized verifier network as the sole verification path for the contract.
Because the smart contract did not enforce a second independent verifier, the bridge processed the fraudulent transfer immediately upon approval. LayerZero stated that it had advised projects to deploy multiple verification networks and subsequently halted serving as a sole required verifier.
Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ. The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly.
— Bryan Pellegrino (臭企鹅) (@PrimordialAA) September 24, 2026
Responding to the legal filing, public comments by Bryan Pellegrino dismissed the claims as completely lacking merit. The executive affirmed that he will vigorously defend the case in Vancouver, rejecting accusations of corporate or personal fault in the exploit.
Infrastructure migration and legal proceedings
KelpDAO rejected LayerZero’s position, stating that the verification architecture was reviewed and confirmed as secure prior to launch. The team argued that the infrastructure firm failed to provide adequate risk disclosures and allowed its own validation nodes to suffer external compromise.
The dispute prompted rapid changes across the industry and accelerated a migration toward alternative networks for asset transfers. KelpDAO announced plans to transition its rsETH bridging mechanism to Chainlink CCIP to eliminate reliance on single infrastructure setups.
The proceedings in British Columbia will test the legal liability of cross-chain communication providers. The court will determine whether financial responsibility rests with front-end configuration choices or with backend failures within node validation systems.
Both parties will submit formal pleadings and technical evidence to the Canadian court according to procedural deadlines set for the coming months. A preliminary hearing date in Vancouver is expected before the end of the current judicial calendar.
This article is for informational purposes only and does not constitute financial advice.
