North Korean Hackers Blamed in Suit
KelpDAO, a decentralized liquid staking protocol built on Ethereum, has filed a lawsuit against LayerZero and its CEO Bryan Pellegrino, following a massive exploit that drained 116,500 rsETH—valued at
The lawsuit specifically points to a North Korean hacking group as the perpetrators behind the exploit, adding an international dimension to the ongoing legal battle. While KelpDAO claims LayerZero failed to disclose risks and did not prevent attackers from compromising its infrastructure, none of these allegations have yet been tested in court.
The exploit occurred on April 18, just days before KelpDAO migrated its rsETH bridge to a new security standard.
$20 Billion TVL Wiped from DeFi
The ramifications of the exploit extended far beyond KelpDAO itself. According to coindesk.com, the incident erased $20 billion in total value locked (TVL) across DeFi protocols—a staggering figure that underscores the interconnectedness and fragility of decentralized finance platforms when core bridges are compromised. Experts at JPMorgan cited this as the most significant single-day loss for DeFi TVL in recent memory.
A single vulnerability triggered cascading aftershocks throughout the ecosystem.
The exploit’s magnitude forced major players like Aave, a leading lending protocol, to scramble for liquidity. Aave reportedly borrowed $300 million to fulfill user withdrawal demands as stablecoin markets reeled from sudden outflows linked to fears over bridge security. The ripple effect highlights how one protocol’s misfortune can rapidly destabilize broader DeFi infrastructure.
LayerZero’s Security Under the Microscope
At the heart of KelpDAO’s legal claim is its assertion that LayerZero’s technology was not only flawed but that these flaws were known—and allegedly endorsed—by LayerZero’s leadership. The bridge exploited by hackers relied on a “1-of-1” setup: only LayerZero’s decentralized verifier network (DVN) was responsible for confirming token locks and mints between chains. Evercrest Technologies, KelpDAO’s developer, claims LayerZero instructed them to adopt this configuration and even approved their draft code as recently as March 2024.
The exploit began when malware was installed on a LayerZero developer’s computer on March 6. Attackers then tampered with internal nodes, ultimately allowing them to forge messages and mint unbacked rsETH tokens worth nearly $292 million by April 18. KelpDAO says it managed to pause its bridges within about an hour after detecting suspicious activity and successfully blocked a second attempted exploit soon after.
See Also
KelpDAO Cites Negligence, Demands Damages
Evercrest Technologies filed its notice of civil claim in the Supreme Court of British Columbia on Wednesday, targeting both LayerZero Labs Ltd. Its Canadian subsidiary, and co-founder Bryan Pellegrino personally. The suit alleges negligent misrepresentation, negligence, and even defamation—demanding aggravated and punitive damages in addition to compensation for direct losses.
KelpDAO argues that not only did LayerZero fail to prevent or mitigate risks in its infrastructure, but it also reviewed and endorsed KelpDAO’s bridge deployment and configuration in writing before launch. This written endorsement forms a critical part of Evercrest’s case, which asserts that LayerZero bears responsibility for instructing KelpDAO to use a setup with no redundancy or fallback verification path—a decision that proved catastrophic when attackers struck.
CEO Pellegrino Calls Lawsuit “Meritless”
In contrast to KelpDAO's allegations, Bryan Pellegrino has dismissed the lawsuit as "meritless" and indicated his intent to defend both himself and his company vigorously in Vancouver courts. An incident report released by LayerZero stated that attackers compromised internal nodes and manipulated their verifier into approving forged cross-chain messages—a scenario made possible because KelpDAO's bridge relied exclusively on one verifier network.
The headline number—$292 million lost—captures attention, but the context is messier: while Evercrest claims explicit endorsement for their setup from LayerZero, it remains uncertain whether such communications will hold up under judicial scrutiny or if broader industry practices will shift as a result of this precedent-setting case.
Key Findings
- •On April 18, 2026, KelpDAO’s rsETH bridge was exploited for 116,500 rsETH, worth $292 million.
- •The exploit erased $20 billion in DeFi total value locked (TVL), with Aave borrowing $300 million to meet withdrawals.
- •KelpDAO alleges LayerZero and CEO Bryan Pellegrino endorsed the vulnerable 1-of-1 bridge setup in writing before the attack.
What remains under scrutiny
Whether LayerZero and its CEO Bryan Pellegrino file a response to Evercrest Technologies’ civil claim in the Supreme Court of British Columbia, as none has been submitted yet, will immediately determine if the allegations of negligent misrepresentation, negligence, and defamation proceed to court review or remain untested.
