Brivv
KelpDAO Sues LayerZero Over $292 Million Exploit, Largest of 2026
CryptoNews3 min readAI-assisted

KelpDAO Sues LayerZero Over $292 Million Exploit, Largest of 2026

KelpDAO has filed a lawsuit against cross-chain protocol LayerZero and co-founder Bryan Pellegrino, alleging undisclosed weaknesses enabled a $292 million

September 25, 2026Source: coindesk.com ↗

KelpDAO has sued LayerZero and its co-founder Bryan Pellegrino, blaming the universal bridge protocol for the largest exploit of 2026, which drained $292 million and triggered one of the largest DeFi runs in crypto history, according to a post on X on Thursday.

"The exploit was a direct result of LayerZero's failures, including a failure to disclose weaknesses and risks inherent in LayerZero's own technology," KelpDAO said. The decentralized liquid staking protocol on Ethereum also accused LayerZero of failing to prevent infiltration of its security infrastructure, which it claims allowed attackers to exploit alleged weaknesses in the bridge.

"Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures," KelpDAO said.

Pellegrino responded that the claim, filed as a notice of civil claim in British Columbia, Canada, is "meritless." "Evercrest (KelpDAO) filed a notice of civil claim today in BC against myself and LZ (LayerZero). The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly," he said.

The April 22 Exploit

A North Korean hack group allegedly attacked KelpDAO's cross-chain bridge on April 22, draining 116,500 rsETH, worth roughly $292 million, at a time when it held nearly a fifth of the restaked token's circulating supply. The fallout spread across stablecoin markets, including forcing Aave, the largest DeFi lending pool, to borrow $300 million to meet rising user demand for asset withdrawals. Days later, the exploit erased $20 billion in total value locked, exposing structural risks in DeFi that were noted by experts, including those at JPMorgan.

KelpDAO said that since the incident it has taken action to protect user assets, including migrating rsETH's bridge to a more secure cross-chain security standard. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem," it said.

Source: CoinDesk

Read Brivv on Telegram

Get the top FinTech & crypto stories first — with a quick take on why they matter.

Subscribe@brivv_com

Related Articles