Evercrest Technologies, the primary development firm behind the liquid restaking protocol KelpDAO, has initiated formal legal proceedings against LayerZero Labs, its Canadian subsidiary, and Chief Executive Officer Bryan Pellegrino. The lawsuit, filed on September 24, centers on a massive security breach involving the protocol’s rsETH bridge that resulted in the unauthorized minting of tokens valued at approximately $292 million. The complaint alleges that the exploit was not the result of a flaw within KelpDAO’s proprietary smart contracts, but rather a catastrophic failure of LayerZero’s own infrastructure and a subsequent breach of professional duty regarding the configuration of the bridge’s security parameters.
The legal action marks a significant escalation in the ongoing tension between the two decentralized finance (DeFi) entities. According to the court documents, Evercrest contends that a series of failures within LayerZero’s Decentralized Verifier Network (DVN) allowed an attacker to manipulate the bridging process, creating "phantom" assets on the Ethereum mainnet that lacked any underlying collateral. The case raises critical questions regarding the liability of cross-chain infrastructure providers and the technical standards required to maintain the integrity of multi-billion dollar liquidity pools.
The Technical Mechanics of the rsETH Bridge Exploit
To understand the core of the dispute, it is necessary to examine the architecture of the rsETH bridge and the role played by LayerZero’s technology. KelpDAO utilizes rsETH as a liquid restaking token (LRT), which allows users to earn additional yields on their staked Ethereum. To facilitate cross-chain movement, KelpDAO employed LayerZero’s messaging protocol to bridge rsETH between Ethereum and Unichain.
The security of this bridge relied on a Decentralized Verifier Network (DVN). In a standard configuration, multiple independent verifiers must confirm a transaction before it is executed on the destination chain. However, Evercrest alleges that LayerZero instructed them to utilize a "1-of-1" configuration, where LayerZero’s own DVN served as the sole arbiter of truth. This setup, while efficient, created a single point of failure.
The complaint alleges that on the day of the exploit, the attacker leveraged "poisoned" Remote Procedure Call (RPC) data. RPCs are the communication gateways that allow servers to interact with the blockchain. By compromising the RPC infrastructure used by LayerZero’s DVN, the attacker was able to feed the verifier false information. Specifically, the DVN was led to believe that 116,500 rsETH had been securely locked on the Unichain side of the bridge. In reality, no such deposit existed. Trusting this manipulated data, the LayerZero DVN issued an attestation that triggered the minting of $292 million worth of rsETH on the Ethereum network, effectively creating value out of thin air.
A Chronology of the Infrastructure Compromise
The lawsuit provides a detailed timeline that suggests the April 18 exploit was the culmination of a security breach that began weeks earlier. Evercrest’s forensic analysis, cited in the filing, indicates that the initial point of entry occurred on March 6, 2026. On this date, an unauthorized party allegedly gained access to a device belonging to a LayerZero developer.
This compromised machine is believed to have provided the foothold necessary for the attackers to study LayerZero’s internal workflows and eventually target the RPC infrastructure. Between March and mid-April, the attackers reportedly mapped out the Decentralized Verifier Network’s dependencies.
On April 18, the exploit was executed with precision. Within a single hour, the attackers manipulated the RPC data to trigger the $292 million mint. Evercrest maintains that its internal monitoring systems identified the anomaly almost immediately. Within sixty minutes of the first unauthorized mint, KelpDAO engineers suspended all LayerZero-connected bridges and successfully froze the attacker’s primary wallet. This rapid response is credited with preventing a second attempted mint of an additional 40,000 rsETH, which would have added nearly $100 million to the total loss.
Conflicting Accounts and the Dispute Over Security Configurations
A central pillar of the lawsuit is the disagreement over who was responsible for the "1-of-1" DVN configuration. Following the incident, LayerZero CEO Bryan Pellegrino made several public statements suggesting that application developers should never rely on a single DVN for security. He argued that KelpDAO’s choice to use a sole verifier was a deviation from best practices and the primary reason the exploit was successful.
Evercrest, however, presents a starkly different narrative supported by internal communications. The complaint alleges that LayerZero Labs not only reviewed and endorsed the bridge configuration but explicitly instructed KelpDAO to use the 1-of-1 setup. Evercrest claims it followed written guidance provided by LayerZero staff, who allegedly assured them that the single-verifier model was appropriate for their specific integration at that stage of the Unichain rollout.
The lawsuit characterizes LayerZero’s public blaming of KelpDAO as a "deflection" intended to protect LayerZero’s reputation at the expense of its clients. Evercrest asserts that if the infrastructure provider’s own developer tools and RPCs were compromised, even a multi-verifier setup might have been vulnerable if those verifiers shared the same underlying data sources managed by LayerZero.
Financial Damages and the Impact on the KelpDAO Ecosystem
The fallout from the April 18 exploit extended far beyond the immediate loss of the minted tokens. Evercrest Technologies is seeking comprehensive damages for what it describes as a near-existential threat to the KelpDAO protocol.
First, Evercrest was forced to undertake a 2,000 ETH recapitalization to maintain the peg and stability of rsETH, a move necessitated by the dilution caused by the attacker’s unauthorized mint. At prevailing market prices, this recapitalization cost the firm millions of dollars in liquid reserves.
Second, the exploit triggered a massive loss of investor confidence. The filing notes that in the weeks following the breach, KelpDAO experienced more than $650 million in user withdrawals. This "bank run" significantly reduced the protocol’s Total Value Locked (TVL), directly impacting its ability to generate fee revenue. The decline in TVL also led to a sharp drop in the valuation of KERNEL, the ecosystem’s governance and utility token, causing further financial pain for stakeholders and the development team.
Furthermore, the lawsuit details several operational setbacks:
- sbUSD Vault Shutdown: The security breach forced the permanent closure of KelpDAO’s sbUSD vault, a key component of its stablecoin strategy.
- Product Delays: A highly anticipated stablecoin product was indefinitely delayed as engineering resources were diverted to security audits and bridge migration.
- Migration Costs: Evercrest incurred substantial legal fees and technical costs associated with migrating its entire infrastructure away from LayerZero to alternative interoperability providers.
- Reputational Harm: The plaintiff argues that the association with a high-profile "hack" has tarnished KelpDAO’s standing in the DeFi community, making it more difficult to secure partnerships and institutional capital.
Broader Implications for Cross-Chain Interoperability and Security Standards
The legal battle between Evercrest and LayerZero is being closely watched by the broader cryptocurrency industry, as it touches upon the fundamental "trustless" nature of blockchain technology. Cross-chain bridges have historically been the most vulnerable points in the crypto ecosystem, with billions of dollars lost to exploits in protocols like Ronin, Wormhole, and Nomad.
This case is unique because it shifts the focus from smart contract bugs to the security of the off-chain infrastructure that supports "decentralized" networks. If the court finds LayerZero liable, it could set a major precedent for the responsibilities of infrastructure providers. It would suggest that being a "neutral" protocol provider does not absolve a company of the duty to protect its own internal developer environments and the RPC data it provides to its clients.
Furthermore, the dispute highlights the risks associated with the complexity of DVN configurations. While LayerZero promotes a modular security model where developers can choose their own verifiers, the KelpDAO incident suggests that the "default" or "recommended" settings provided by the platform carry significant weight. If developers are told by a provider that a certain configuration is safe, the provider may be held to a higher standard of care if that configuration fails due to the provider’s own internal security lapses.
Official Responses and Industry Reaction
While LayerZero Labs and Bryan Pellegrino have yet to file a formal legal response to the September 24 complaint, their previous public stances suggest a vigorous defense. Pellegrino has consistently maintained that LayerZero is a permissionless protocol and that the ultimate responsibility for security parameters lies with the individual decentralized applications (dApps) that build on top of it. In past social media interactions, he has emphasized that the "1-of-1" configuration is an opt-in choice and that the protocol offers the tools for much more robust, multi-sig style verification if the user chooses to implement it.
The DeFi community remains divided on the issue. Some security researchers argue that KelpDAO should have been more skeptical of a single-verifier setup, regardless of LayerZero’s advice. Others point out that if LayerZero’s developer machines were indeed compromised, it represents a fundamental breach of trust that undermines the entire LayerZero stack.
As the case moves through the judicial system, the discovery phase is expected to reveal internal logs and communications that will clarify whether the RPC poisoning was an avoidable failure on LayerZero’s part or an unprecedented sophisticated attack that could have bypassed even the most stringent industry standards. For now, the $292 million lawsuit stands as a stark reminder of the fragile dependencies that underpin the multi-chain future of finance.
