KelpDAO sues LayerZero, CEO over $292M rsETH bridge exploit
In brief
- Evercrest Technologies sued LayerZero and CEO Bryan Pellegrino over $292M rsETH bridge exploit on Unichain.
- Lawsuit alleges LayerZero's compromised infrastructure and manipulated RPC data enabled attackers to mint tokens without deposits.
- Evercrest claims LayerZero endorsed the 1-of-1 DVN configuration then blamed KelpDAO for the security setup.
- Incident triggered $650M user withdrawals and significant KelpDAO asset and fee revenue losses.
- Evercrest seeks damages for negligent misrepresentation, negligent services, and defamation.
The Attack Vector
Evercrest's statement of claim outlines a multi-step breach. An attacker compromised a LayerZero developer's machine on March 6, 2026, then targeted RPC infrastructure used by LayerZero's Decentralized Verifier Network on April 18. The manipulated RPCs allegedly caused LayerZero's DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place.
With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation resulted in the minting of roughly $292 million in rsETH on Ethereum. Evercrest identified the attack within an hour, suspended its LayerZero bridges, froze the attacker's wallet and stopped a second attempted mint of 40,000 rsETH—limiting further damage.
Blame-Shifting and Contractual Disputes
The core dispute centers on responsibility. LayerZero later blamed KelpDAO's single-verifier configuration. CEO Pellegrino said applications should not rely on a sole DVN. Evercrest disputes this framing entirely.
"Evercrest also disputes LayerZero's public account of the incident, alleging that LayerZero had reviewed and endorsed KelpDAO's bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup." According to the lawsuit, Evercrest maintains it followed LayerZero's written instructions and that LayerZero endorsed the exact setup now being criticized.
"Evercrest also disputes LayerZero's public account of the incident, alleging that LayerZero had reviewed and endorsed KelpDAO's bridge configuration and instructed the company to use its own DVN in a 1-of-1 setup." — Evercrest Technologies, statement of claim
Financial Fallout and Legal Claims
The incident triggered cascading losses. Evercrest alleges the fallout included more than $650 million in user withdrawals, lower assets under management and fee revenue, a decline in KERNEL, the closure of the sbUSD vault and additional legal, forensic and migration costs.
Evercrest is seeking damages under claims including negligent misrepresentation, negligent provision of services and defamation. The lawsuit underscores the tension between bridge developers and infrastructure providers over accountability when multi-signature or single-verifier architectures fail—a recurring fault line in decentralized finance.
