KelpDAO developer sues LayerZero, CEO over $292 million exploit and blame-shifting

KelpDAO developer Evercrest Technologies has taken LayerZero and CEO Bryan Pellegrino to court over a $292 million exploit of the protocol’s rsETH bridge, alleging that LayerZero-owned infrastructure was compromised and enabled attackers to mint tokens without corresponding deposits. Evercrest’s statement of claim says the incident was not caused by a vulnerability in KelpDAO’s contracts but by a combination of poisoned RPC data, a compromised developer device and a 1-of-1 LayerZero DVN configuration. The complaint alleges that an attacker compromised a LayerZero developer’s machine on March 6, 2026, before targeting RPC infrastructure used by LayerZero’s Decentralized Verifier Network on April 18. The manipulated RPCs allegedly caused LayerZero’s DVN to confirm that 116,500 rsETH had been locked on Unichain despite no actual lock taking place. With LayerZero acting as the sole verifier for the Unichain Bridge, the false attestation allegedly resulted in the minting of roughly $292 million in rsETH on Ethereum. Evercrest says it identified the attack within an hour, suspended its LayerZero bridges, froze the attacker’s wallet and stopped a second attempted mint of 40,000 rsETH. Eve...