Evercrest Technologies, the developer behind KelpDAO, has filed a civil lawsuit in British Columbia against LayerZero and its CEO Bryan Pellegrino over an April 2026 exploit that drained $292 million from its rsETH bridge. Evercrest alleges that LayerZero's compromised security infrastructure enabled the attack and that LayerZero had previously endorsed the 1-of-1 bridge configuration in writing. Pellegrino has dismissed the lawsuit as meritless and pledged to defend the case in Vancouver.
Legal action filed by Evercrest Technologies
- ▪LayerZero co-founder and CEO Bryan Pellegrino publicly stated that Evercrest Technologies' lawsuit is meritless and announced he would defend himself and LayerZero in court in Vancouver, British Columbia
- ▪Evercrest Technologies filed a civil claim against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and Bryan Pellegrino in the Supreme Court of British Columbia on September 24, 2026
- ▪Evercrest Technologies' lawsuit pleads negligent misrepresentation, negligence, and defamation, seeking aggravated and punitive damages for losses including over $650 million in user withdrawals and the shutdown of KelpDAO's sbUSD product following the April 18 exploit
Dispute over LayerZero's verifier configuration
- ▪Evercrest Technologies claims LayerZero reviewed and endorsed KelpDAO's 1-of-1 verifier configuration in writing, stating on February 2, 2024, that there was "no problem" using the default DVN configuration
- ▪Evercrest Technologies alleges LayerZero warned another developer, USDT0, about risks in LayerZero's default verifier configurations in late 2024 or early 2025 but failed to provide any comparable warning to Evercrest Technologies
- ▪LayerZero's incident report stated that KelpDAO's 1-of-1 configuration contradicted a multi-DVN model it consistently recommended, though LayerZero later admitted it made a mistake by allowing LayerZero's own DVN to act as a 1-of-1 DVN
How the attacker executed the exploit
- ▪An attacker in the April 18 rsETH bridge exploit tampered with LayerZero's nodes and manipulated RPC infrastructure, causing LayerZero's verifier to approve a forged cross-chain message that 116,500 rsETH had been locked on Unichain
- ▪The rsETH bridge exploit began on March 6, 2026, when an attacker used social engineering to install malware on a LayerZero developer's computer
Impact of the rsETH bridge exploit
- ▪The April 18 rsETH bridge exploit triggered a liquidity crisis that erased $20 billion in decentralized finance deposits and forced Aave to borrow $300 million to meet withdrawal demands
- ▪An attacker exploited KelpDAO's rsETH bridge on April 18, 2026, resulting in the theft of 116,500 rsETH worth approximately $292 million
Debatable claims
- ▪LayerZero bears primary responsibility for the $292 million KelpDAO exploit
- ▪Bryan Pellegrino bears personal liability for the KelpDAO exploit
- ▪LayerZero's public statements blaming KelpDAO's configuration were defamatory
Story comments
Loading comments…