The decentralized finance (DeFi) sector is facing a landmark legal confrontation as Evercrest Technologies, the primary development firm behind the liquid restaking protocol KelpDAO, has officially initiated legal proceedings against LayerZero Labs. The lawsuit, filed in a Canadian court on September 24, 2026, names LayerZero Labs, its Canadian corporate entity, and Chief Executive Officer Bryan Pellegrino as defendants. The litigation centers on a catastrophic security breach involving the rsETH bridge—a critical piece of infrastructure powered by LayerZero—which resulted in the unauthorized minting and subsequent loss of approximately $292 million in assets.
The complaint details a sophisticated exploit that occurred on April 18, 2026, targeting the bridge between Unichain and the Ethereum mainnet. While initial market reactions suspected a flaw within KelpDAO’s smart contracts, the legal filing by Evercrest Technologies asserts a different narrative. The plaintiff alleges that the root cause was not a vulnerability in their own code, but rather a systemic failure within LayerZero’s infrastructure, compounded by compromised developer credentials and a highly specific, allegedly endorsed, configuration that left the protocol vulnerable to a single point of failure.
The Anatomy of the Exploit: A Multi-Stage Breach
According to the legal documents, the breach was the culmination of a months-long operation by unidentified malicious actors. Evercrest alleges that the security chain first began to unravel on March 6, 2026, when an attacker successfully compromised a workstation belonging to a LayerZero developer. This initial foothold allowed the hackers to gain deep insights into LayerZero’s internal operations and its Decentralized Verifier Network (DVN) infrastructure.
In the weeks following the initial compromise, the attackers shifted their focus toward the Remote Procedure Call (RPC) infrastructure utilized by LayerZero’s DVNs. RPCs serve as the communication backbone for blockchain nodes, allowing different software components to interact and share data about the state of the network. By "poisoning" the RPC data, the attackers were able to feed fraudulent information to the LayerZero verifiers.
On April 18, the exploit reached its climax. The manipulated RPCs allegedly tricked LayerZero’s DVN into believing that 116,500 rsETH had been securely locked into a vault on Unichain. In reality, no such transaction had occurred. However, because the LayerZero DVN accepted this poisoned data as truth, it issued a formal attestation to the Ethereum mainnet. Relying on this attestation, the bridge contract on Ethereum minted 116,500 new rsETH tokens, valued at approximately $292 million, directly into the attacker’s wallet.
Evercrest Technologies claims that its security team identified the anomaly within 60 minutes of the first unauthorized mint. The company immediately moved to suspend all LayerZero-based bridges and coordinated with centralized exchanges and security firms to freeze the attacker’s known addresses. This rapid response reportedly prevented a second attempted minting of an additional 40,000 rsETH, which would have increased the total losses by nearly $100 million.
The "1-of-1" Configuration Dispute
The crux of the legal dispute lies in the technical configuration of the bridge’s verification process. LayerZero’s "V2" architecture allows applications to choose their own set of verifiers, known as Decentralized Verifier Networks (DVNs). In the case of the rsETH bridge, the protocol was running a "1-of-1" setup, meaning that a single DVN—operated by LayerZero—was the sole entity responsible for confirming the validity of cross-chain messages.
In the aftermath of the hack, LayerZero CEO Bryan Pellegrino publicly addressed the incident, suggesting that the fault lay with KelpDAO for relying on a single-verifier setup. Pellegrino argued that decentralized applications (dApps) should never rely on a sole DVN, as it creates a centralized point of failure that contradicts the security philosophy of the LayerZero protocol.
Evercrest Technologies’ complaint directly contradicts this defense. The filing alleges that LayerZero Labs not only reviewed and endorsed KelpDAO’s bridge configuration but specifically instructed the Evercrest team to utilize the 1-of-1 setup during the integration process. Evercrest maintains that they followed written instructions and technical guidance provided by LayerZero’s own engineers. The lawsuit characterizes LayerZero’s subsequent public blaming of KelpDAO as a "bad faith" attempt to deflect responsibility for a breach that originated within LayerZero’s own compromised developer environment.
Quantifying the Damages: Beyond the Initial Loss
Evercrest Technologies is seeking comprehensive damages that extend far beyond the $292 million in stolen rsETH. The lawsuit provides a detailed breakdown of the financial and operational devastation the exploit caused to the KelpDAO ecosystem.
- Recapitalization Costs: To maintain the peg of rsETH and ensure the protocol remained solvent, Evercrest was forced to undertake a massive recapitalization effort, which included the injection of 2,000 ETH (approximately $5 million at the time) to cover immediate gaps.
- Massive Capital Outflow: The breach triggered a crisis of confidence among users. The filing notes that in the weeks following the exploit, KelpDAO experienced more than $650 million in user withdrawals as investors sought to move their capital to perceived safer alternatives in the liquid restaking market.
- Lost Revenue and Product Delays: The incident forced the immediate shutdown of KelpDAO’s sbUSD vault and caused an indefinite delay in the launch of a new stablecoin product. Evercrest claims these disruptions resulted in millions of dollars in lost fee revenue.
- Token Devaluation: The protocol’s native utility and governance aspirations, tied to the "KERNEL" points system and its future tokenomics, suffered a significant blow. The lawsuit alleges that the reputational damage has permanently impaired the value of the KelpDAO ecosystem.
- Operational Expenses: Evercrest is seeking reimbursement for legal fees, forensic auditing costs, and the expenses associated with migrating their entire infrastructure away from LayerZero to alternative interoperability providers.
Context: The High Stakes of Liquid Restaking
To understand the magnitude of this lawsuit, one must look at the broader context of the Ethereum "restaking" ecosystem. KelpDAO is a prominent player in the Liquid Restaking Token (LRT) space, which allows users to deposit staked assets (like ETH or LSTs) to earn additional rewards by securing secondary services via protocols like EigenLayer.
In this ecosystem, rsETH acts as a receipt token that represents the user’s underlying staked position. Because these tokens are intended to be used as collateral across various DeFi platforms, any doubt regarding their backing can have systemic implications for the entire market. A $292 million hole in the backing of rsETH doesn’t just affect KelpDAO; it threatens the liquidity pools and lending protocols where rsETH is integrated.
LayerZero, as an interoperability layer, serves as the "connective tissue" for these assets. If the market loses faith in the security of the bridges that move these billions of dollars in value, the entire multi-chain thesis of modern DeFi is put at risk.
Industry Reactions and Potential Precedents
The lawsuit has sent ripples through the blockchain developer community. For years, the mantra in DeFi has been "code is law," with the implication that users and developers accept the inherent risks of experimental software. However, as the industry matures and institutional capital enters the space, the legal system is increasingly being used to adjudicate "duty of care" in software development.
Legal experts suggest that this case could set a significant precedent regarding the liability of infrastructure providers in the Web3 space. If the court finds that LayerZero Labs provided negligent instructions or failed to secure its internal developer environment, it could open the door for similar lawsuits against other cross-chain protocols and oracle providers.
Conversely, if the court sides with LayerZero, it will reinforce the responsibility of application developers to perform their own due diligence and implement redundant security measures, regardless of the recommendations provided by third-party service providers.
Chronology of Key Events
- March 6, 2026: A LayerZero developer’s machine is allegedly compromised by an external attacker, providing an entry point into the protocol’s internal systems.
- Early April 2026: Attackers begin manipulating RPC data used by LayerZero’s Decentralized Verifier Networks.
- April 18, 2026: The exploit occurs. Poisoned data leads to the false attestation of 116,500 rsETH on Unichain. The bridge mints $292 million worth of rsETH on Ethereum.
- April 18, 2026 (One hour later): Evercrest identifies the attack, halts bridges, and prevents a second minting attempt of 40,000 rsETH.
- Late April – May 2026: Public back-and-forth between Bryan Pellegrino and Evercrest regarding the "1-of-1" DVN configuration. KelpDAO faces $650 million in withdrawals.
- September 24, 2026: Evercrest Technologies files a formal complaint against LayerZero Labs and Bryan Pellegrino in Canada.
The Path Forward
As the legal process begins, the DeFi community is watching closely. LayerZero has yet to release a formal response to the specific allegations contained in the September 24 filing, though the company has historically maintained that the security of individual configurations remains the responsibility of the dApp developers.
For KelpDAO, the lawsuit represents a "bet-the-company" move to recover losses and restore its standing in the competitive restaking market. For the broader industry, the case serves as a stark reminder of the vulnerabilities that persist at the intersection of human error (compromised devices) and complex technical architecture (RPC poisoning and bridge configurations).
As the $292 million recovery effort continues, the focus remains on whether the legal system can provide a remedy for the technical failures of decentralized systems, or if this will remain another chapter in the long history of costly lessons in the evolution of blockchain technology. Regardless of the outcome, the relationship between infrastructure providers and the applications that build upon them has been fundamentally altered.
