Evercrest Technologies sues LayerZero and CEO Pellegrino over $292M rsETH bridge exploit
Evercrest Technologies, the company behind KelpDAO, sued LayerZero and CEO Bryan Pellegrino in British Columbia over the April exploit that released 116,500 rsETH worth about $292 million.
Read this event in español, français, Indonesia, português (Brasil), Türkçe, 中文（中国）
Why it matters
The case puts responsibility for cross-chain bridge losses on trial, with KelpDAO saying LayerZero endorsed the single-verifier setup in writing and LayerZero saying the configuration was the customer's choice. CryptoSlate reports that projects holding about $14.5 billion in assets announced moves from LayerZero to Chainlink's CCIP by August 4, so the dispute is already showing up in infrastructure choices and in user withdrawals.
Where the sources disagree
Cause of the bridge failure
Direct result of LayerZero's failures, including undisclosed weaknesses
CoinDesk, CryptoPotato, Crypto.News
Attack was isolated to KelpDAO's 1-of-1 configuration, which LayerZero says it did not recommend
Crypto.News, CryptoPotato
KelpDAO blames undisclosed weaknesses and an intrusion into LayerZero infrastructure, while CryptoPotato reports LayerZero maintained the attack was isolated to KelpDAO's rsETH configuration and that it had advised using multiple verifiers; KelpDAO says that account is wrong and cites a May 6 report.
Co-founder's first name
April 18, 2026
Crypto.News, Cointelegraph, Unchained, Bitcoin.com News, Decrypt, CryptoPotato, CryptoSlate, CoinDesk
April 22, 2026
CoinDesk
CoinDesk's headline spells the co-founder's name Brian Pellegrino, while the rest of the coverage spells it Bryan.
Which date the notice of civil claim was filed and where
Notice of civil claim dated Sept. 24, published late Thursday
Unchained, Bitcoin.com News
Filed Wednesday
Decrypt
Unchained and Bitcoin.com News say the notice of civil claim is dated September 24 and was published late Thursday, while Decrypt says Evercrest filed the claim on Wednesday.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$292
CryptoPotato
$650
CryptoSlate
CryptoPotato reports $292, CryptoSlate reports $650 (55% apart).
amount taken
$292 million
CryptoPotato
$650 million
CryptoSlate
CryptoPotato reports $292 million, CryptoSlate reports $650 million (55% apart).
Key facts
Evercrest Technologies filed a civil claim in the Supreme Court of British Columbia against LayerZero Labs, its Canadian affiliate and CEO Bryan Pellegrino over the April exploit of KelpDAO's rsETH bridge.
292,000,000 USDReported by Crypto.News
The April attack released 116,500 rsETH worth about $292 million that was not backed by deposits, in a single block.
116,500 rsETHDisputed figureReported by Crypto.News
The claim pleads negligent misrepresentation, negligence and defamation and seeks damages including aggravated and punitive damages, without naming a damages figure.
Reported by Unchained
KelpDAO alleges LayerZero reviewed and endorsed its deployment and configuration in writing, including in February 2024, March 2024 and January 2025, and at one point told it to copy another single-verifier bridge configuration.
Disputed figureReported by Cointelegraph
LayerZero later linked the attack to North Korea's Lazarus Group.
Reported by Unchained
Pellegrino called the lawsuit meritless and said he would defend himself and LayerZero in Vancouver.
Reported by Crypto.News
What happened
Evercrest Technologies Inc., the company that provides the Kelp application, filed a notice of civil claim dated September 24 in the Supreme Court of British Columbia against LayerZero Labs Ltd., LayerZero Labs Canada Inc. and co-founder and CEO Bryan Pellegrino over the April 18 exploit on the Unichain bridge, which released 116,500 rsETH worth about $292 million and was not backed by deposits. The claim pleads negligent misrepresentation, negligence and defamation, seeks aggravated and punitive damages, and puts no dollar figure on the loss, though it says the exploit and LayerZero's public statements cost Evercrest tens of millions of dollars. KelpDAO says LayerZero failed to disclose weaknesses in its technology, failed to stop attackers reaching infrastructure used by its verifier, and endorsed the deployment and configuration in writing; CryptoSlate, citing LayerZero's incident report, says the intrusion started with a LayerZero developer who was socially engineered into cloning a malicious GitHub repository in March, after which attackers reached the RPC environment, poisoned two internal nodes and took an external RPC provider offline, so the verifier signed a forged transfer. LayerZero disputes the claim: CryptoPotato reports LayerZero maintained it had recommended multiple Decentralized Verifier Networks to avoid a single point of failure and argued the attack was isolated to KelpDAO's rsETH configuration, while KelpDAO points to a May 6 report rejecting that account, and Crypto.News reports the company said KelpDAO's 1-of-1 verifier setup created the single failure point. Pellegrino called the lawsuit meritless and said he would defend himself and LayerZero in Vancouver. Two details conflict across coverage: the attack date is given as April 18 by most outlets and April 22 by CoinDesk, and CoinDesk attributes a $20 billion fall in DeFi deposits to the attack while CryptoSlate reports more than $650 million in Kelp user withdrawals and roughly $14.5 billion in assets announcing migrations to Chainlink's CCIP by August 4. Decrypt also reports that the Canadian arm is named in the claim and that Pellegrino is sued personally over Telegram and X posts; no court has ruled on any of the allegations.
How the story developed
- Official statement
Evercrest Technologies files the civil claim and Pellegrino calls it meritless
KelpDAO said on September 24 that Evercrest filed the action; KelpDAO posted a statement on X on September 25, and Pellegrino said the claims are meritless and will be defended in Vancouver.
- First report
First report by Crypto.News
KelpDAO sues LayerZero over $292M rsETH exploit
- Update
Attackers release 116,500 rsETH worth about $292 million from the Unichain bridge
A forged cross-chain message passed a single LayerZero verifier; the attacker then borrowed real assets from Aave, which Bitcoin.com News says left Aave facing an estimated $123.7M to $230.1M in bad debt.
- Independent corroboration
Independently corroborated by Cointelegraph
KelpDAO sues LayerZero, CEO over $292M rsETH bridge exploit
- Official statement
LayerZero links the attack to the Lazarus Group
- Official statement
Official statement from Bitcoin.com News
KelpDAO Takes Layerzero to Court Over a $292M Bridge Blowup
- Update
KelpDAO publishes a report pushing back on LayerZero's account of the configuration
KelpDAO cited the May 6 report when rejecting LayerZero's claim that the loss came from KelpDAO's own rsETH configuration.
- Update
LayerZero traces the breach to a developer who cloned a malicious GitHub repository
Attackers reached LayerZero's RPC environment, poisoned two internal nodes and knocked an external RPC provider offline, so the verifier signed a message built on false source-chain data.
- Update
Projects holding about $14.5 billion announce moves from LayerZero to Chainlink's CCIP
CryptoSlate reports the figure as of August 4, nearly 50 times the amount stolen, and says Kelp users have withdrawn more than $650 million since the attack.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 25 Sept 2026, 05:51 UTC: Crypto.News — 1 independent source, 1 reports
- 25 Sept 2026, 07:56 UTC: Bitcoin Insider — 2 independent sources, 2 reports
- 25 Sept 2026, 08:51 UTC: Cointelegraph — 3 independent sources, 3 reports
- 25 Sept 2026, 08:58 UTC: CoinDesk — 4 independent sources, 4 reports
- 25 Sept 2026, 10:22 UTC: Unchained — 5 independent sources, 5 reports
- 25 Sept 2026, 10:30 UTC: Bitcoin.com News, official — 6 independent sources, 6 reports
- 25 Sept 2026, 11:09 UTC: Decrypt — 7 independent sources, 7 reports
- 25 Sept 2026, 20:16 UTC: CryptoPotato — 8 independent sources, 8 reports
- 26 Sept 2026, 13:30 UTC: CryptoSlate — 9 independent sources, 9 reports
Affected entities
Also mentioned: U.S. Securities and Exchange Commission, Solana, JPMorgan, Cardano, Robinhood, Liquid Network
Original sources
Related events
Aave considers higher Bitcoin and ether borrowing limits as liquidation price cushions narrow
Aave governance is weighing proposals that would raise Bitcoin and ether borrowing limits while narrowing the buffer before liquidation.
Standard Chartered's Kendrick sets 2030 targets for Aave, Morpho, Uniswap, Arbitrum
Standard Chartered's Geoffrey Kendrick told Milk Road Crypto that Aave could reach $3,500 and Morpho $60 by 2030, and named Uniswap and Arbitrum alongside them, as Crypto News reported.
Chainalysis says a task-scam operator lost 60 BTC to the tampered Ledger drain
A task-scam operator lost 60 BTC, about $4.8 million, when thieves emptied three tampered Ledger addresses into one wallet, Chainalysis says.
Drift Protocol exploiter moves 44,510 ETH to Tornado Cash over two days after six-month dormancy
Wallets linked to the April Drift exploit sent 44,510 ETH worth $109 million to Tornado Cash on October 20-21, retaining approximately 56,569 ETH.
$387 million stolen from Bitget traced to North Korea-linked actors across four chains
Chainalysis traced $387 million stolen from Bitget in 23 transfers across four chains and attributed the September 24 breach to North Korea-linked actors.
