KelpDAO sues LayerZero for the largest exploit 2026 has seen so far

KelpDAO filed a lawsuit against LayerZero and its co-founder, blaming the universal bridge protocol for the largest exploit of this year, which drained $292 million and triggered one of the largest DeFi runs in crypto history, according to a post on X on Thursday.

“The exploit was a direct result of LayerZero’s failures, including a failure to disclose weaknesses and risks inherent in LayerZero’s own technology,” KelpDAO said.

KelpDAO, a decentralized liquid staking protocol on Ethereum, also accused LayerZero of failing to prevent infiltration of its security infrastructure, claiming that this allowed attackers to exploit the universal bridge’s alleged weaknesses.

“Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures,” KelpDAO said.

Pellegrino immediately responded that he would see them in a Canadian court.

“Evercrest (KelpDAO) filed a notice of civil claim today in BC (British Columbia, Canada) against myself and LZ (LayerZero),” Pellegrino said. “The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.”

A North Korean hack group allegedly attacked KelpDAO’s cross-chain bridge on April 22. At the time, it was holding nearly a fifth of the restaked token’s circulating supply, draining 116,500 rsETH, worth roughly $292. The aftershocks of the exploit spread across stablecoin markets, including forcing Aave, the largest decentralized finance (DeFi) lending pool, to borrow $300 million to meet increasing user demand for asset withdrawals. Days later, the exploit erased $20 billion in total value locked (TVL), exposing the structural risks still present in DeFi, according to experts, including those at JPMorgan.

KelpDAO also said that, since the incident, it has taken action to ensure user assets are safe and protected, including migrating rsETH’s bridge to a more secure cross-chain security standard.

“But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem,” it said.