The decentralized finance ecosystem is facing a significant legal confrontation as Evercrest Technologies, the primary development firm behind the liquid restaking protocol KelpDAO, has officially filed a lawsuit against LayerZero Labs, its Canadian subsidiary, and its Chief Executive Officer, Bryan Pellegrino. The legal action, initiated in late September 2026, stems from a catastrophic security breach involving the protocol’s rsETH bridge—a cross-chain infrastructure designed to move liquid restaking tokens across various blockchain networks. The exploit, which occurred in April 2026, resulted in the fraudulent minting and subsequent loss of approximately $292 million, sending shockwaves through the Ethereum restaking landscape and sparking a heated debate over the security responsibilities of interoperability providers.
The complaint, filed on September 24, 2026, outlines a sophisticated multi-stage attack that Evercrest alleges was made possible not by flaws in KelpDAO’s proprietary smart contracts, but rather by critical vulnerabilities within LayerZero’s infrastructure and the specific configuration mandates provided by LayerZero’s team. At the heart of the dispute is the "Decentralized Verifier Network" (DVN) configuration, a cornerstone of LayerZero’s V2 architecture, which Evercrest claims was improperly managed and mandated by the defendants.
Technical Origins of the 292 Million Dollar Exploit
According to the legal filings, the genesis of the security failure dates back to March 6, 2026, several weeks prior to the actual theft. Evercrest alleges that an unidentified attacker successfully compromised the workstation of a LayerZero developer. This initial point of entry reportedly allowed the malicious actor to gain deep insights into the internal workings and configurations of LayerZero’s Decentralized Verifier Network.
The attack culminated on April 18, 2026, when the perpetrator targeted the Remote Procedure Call (RPC) infrastructure utilized by LayerZero’s DVN. RPCs serve as the primary communication channel between blockchain nodes and external applications; by "poisoning" this data, the attacker was able to feed the DVN fabricated information. Specifically, the manipulated RPC data convinced the LayerZero verifier that 116,500 rsETH had been securely locked on Unichain, a nascent blockchain environment.
In reality, no such deposit had occurred. However, because the bridge was configured with LayerZero acting as the sole verifier for the Unichain Bridge—a "1-of-1" configuration—there was no secondary check to dispute the false attestation. Based on this single, compromised source of truth, the LayerZero protocol signaled the Ethereum mainnet to mint $292 million worth of rsETH, which the attacker then sought to liquidate or move.
Evercrest’s technical team reportedly identified the anomaly within 60 minutes of the fraudulent minting. The company moved aggressively to suspend its LayerZero-integrated bridges and successfully froze the attacker’s primary wallet. This rapid intervention prevented an even larger catastrophe, as the developer managed to intercept and block a second attempted minting of an additional 40,000 rsETH, which would have added over $100 million to the total loss.
The Core Dispute: Responsibility and Configuration Mandates
The legal battle hinges on a fundamental disagreement regarding who controlled the security parameters of the bridge. LayerZero’s V2 architecture is marketed as a modular system where application developers can choose their own "Security Stack," selecting multiple verifiers to ensure a decentralized consensus. However, Evercrest alleges that in the case of the rsETH bridge, the "decentralized" aspect was non-existent in practice.
The complaint asserts that LayerZero Labs not only reviewed and endorsed KelpDAO’s bridge configuration but specifically instructed Evercrest to utilize LayerZero’s own DVN in a 1-of-1 setup. In such a configuration, the security of the entire bridge rests on the integrity of a single verifier. Evercrest maintains that they followed the written technical instructions provided by LayerZero staff, trusting the expertise of the interoperability provider.
In the aftermath of the exploit, the public narrative shifted. Bryan Pellegrino, CEO of LayerZero Labs, publicly stated that applications should never rely on a single DVN and blamed the exploit on KelpDAO’s decision to use a 1-of-1 configuration. Evercrest’s lawsuit characterizes these statements as a "misleading" attempt to shift blame, arguing that LayerZero is now disavowing the very setup they previously mandated and validated for the rsETH deployment.
Financial Damages and Operational Fallout
The impact on KelpDAO and the broader liquid restaking ecosystem has been profound. Evercrest Technologies is seeking comprehensive damages that reflect both the direct capital loss and the long-term operational damage caused by the breach. The filing details several categories of financial harm:
- Recapitalization Costs: Evercrest is seeking the recovery of 2,000 ETH used in initial efforts to stabilize the protocol and maintain the peg of rsETH following the exploit.
- Massive User Outflows: The breach triggered a crisis of confidence among KelpDAO users. The lawsuit notes that the protocol suffered more than $650 million in user withdrawals as investors sought to mitigate risk, leading to a massive reduction in Total Value Locked (TVL).
- Revenue and Token Devaluation: The decline in TVL resulted in a significant loss of transaction fee revenue. Furthermore, the protocol’s native governance and utility ecosystem, including the KERNEL token, saw a sharp decline in market valuation.
- Product Delays and Vault Shutdowns: The security crisis forced the permanent shutdown of KelpDAO’s sbUSD vault and caused an indefinite delay in the launch of a highly anticipated stablecoin product.
- Legal and Migration Expenses: Evercrest is seeking reimbursement for the substantial legal fees incurred during the investigation and the costs associated with migrating their entire infrastructure away from LayerZero to alternative bridge providers.
Beyond the quantifiable numbers, the lawsuit emphasizes "reputational harm." KelpDAO was positioned as a leader in the Ethereum restaking space, a sector that relies heavily on trust and the perceived "risk-free" nature of the underlying assets. The association with a $292 million exploit has significantly tarnished that brand.
Context: The Rise of Liquid Restaking and Interoperability Risks
To understand the scale of this lawsuit, one must look at the state of the decentralized finance (DeFi) market in 2026. Liquid Restaking Tokens (LRTs) like rsETH allow users to earn additional yields by "restaking" their staked Ethereum into secondary security modules via platforms like EigenLayer. Because these tokens are intended to be used across the entire DeFi ecosystem—on Layer 2s, sidechains, and various lending protocols—the bridges that transport them are critical pieces of infrastructure.
LayerZero has long been a dominant player in the cross-chain space, positioning itself as an "omnichain" protocol. Its V2 upgrade was supposed to enhance security by allowing developers to mix and match verifiers (such as Google Cloud, Chainlink, or specialized DVNs). The KelpDAO exploit, however, highlights the "Oracle Problem" in a new light: if the verifier itself is compromised at the RPC level, the entire bridge fails regardless of how robust the smart contracts are.
The industry has seen similar disputes in the past, such as the Nomad bridge hack or the Ronin Network exploit, but the Evercrest vs. LayerZero case is unique because it centers on the professional advice and configuration requirements provided by a service provider to its client.
Broader Implications for the DeFi Industry
The outcome of this lawsuit could set a major legal precedent for the cryptocurrency industry. If the court finds LayerZero Labs liable for the exploit due to its configuration instructions, it could change how infrastructure providers interact with decentralized applications (dApps).
For years, the "code is law" mantra and the permissionless nature of blockchain have shielded developers from traditional liability. However, as the industry matures and entities like Evercrest Technologies and LayerZero Labs operate as formal corporate structures, the legal system is increasingly being used to adjudicate technical failures.
If Evercrest is successful, infrastructure providers may become much more cautious about providing "best practice" advice or "endorsing" specific configurations, potentially leading to more rigorous auditing requirements for cross-chain setups. Conversely, if LayerZero is exonerated, it will reinforce the principle of "caveat emptor" (buyer beware) for dApp developers, placing the entire burden of security verification on the teams that integrate third-party protocols, regardless of the instructions they receive.
Chronology of the Evercrest-LayerZero Conflict
- March 6, 2026: A LayerZero developer’s device is allegedly compromised by an external attacker, providing the blueprint for the future exploit.
- Late March 2026: KelpDAO configures its rsETH bridge using a 1-of-1 DVN setup, allegedly under the direct guidance and endorsement of LayerZero Labs.
- April 18, 2026: The attacker poisons the RPC data of the LayerZero DVN. The DVN falsely attests to a deposit on Unichain.
- April 18, 2026 (09:00 UTC): $292 million in rsETH is minted on Ethereum based on the false attestation.
- April 18, 2026 (10:00 UTC): Evercrest identifies the breach, freezes the attacker’s wallet, and halts the bridge, preventing an additional $100 million loss.
- May – August 2026: Public back-and-forth between Bryan Pellegrino and the KelpDAO community. Pellegrino attributes the loss to the 1-of-1 configuration; Evercrest claims they were following orders.
- September 24, 2026: Evercrest Technologies files a formal complaint against LayerZero Labs and Bryan Pellegrino, seeking hundreds of millions in damages.
As the legal proceedings move forward, the DeFi community remains watchful. The case represents a intersection of high-stakes finance, complex software engineering, and traditional tort law. With $292 million at the center of the storm and over $650 million in lost liquidity, the resolution of this case will likely define the security standards and liability frameworks for the next generation of cross-chain interoperability. Neither LayerZero Labs nor Bryan Pellegrino have issued a formal legal rebuttal at the time of this report, though the industry expects a vigorous defense centered on the decentralized and non-custodial nature of the LayerZero protocol.
