Kelp DAO has initiated legal action against LayerZero and its co-founder Bryan Pellegrino following the April 2026 exploit of the rsETH bridge. The incident resulted in the loss of approximately 116 500 rsETH tokens, valued at $292 million, marking it as the largest DeFi security breach of the year.
The lawsuit alleges that LayerZero concealed technological vulnerabilities and failed to prevent unauthorized access to its security infrastructure. According to the complaint, attackers compromised remote procedure call nodes to transmit fraudulent data to the bridge verifier. This allowed for the approval of a non-existent token burn, triggering the release of funds from the Ethereum contract.
LayerZero has countered these claims by citing the specific configuration of the bridge, which utilized a single verifier managed by LayerZero Labs. The exploit caused significant market disruption, including an $8,45 billion decline in the total value locked on Aave within two days. Kelp DAO asserts that LayerZero had previously provided written endorsement of the deployment setup.
In response to the breach, Kelp DAO is transitioning its bridge to the Chainlink CCIP standard. Meanwhile, legal proceedings regarding the stolen assets continue, including a May 2026 US court order that prevented Arbitrum DAO from transferring 30 766 ETH frozen from the attackers. The current lawsuit aims to establish the liability of infrastructure providers for exploits occurring on client deployments.
