Evercrest Technologies, the organization behind KelpDAO, submitted a notice of civil claim at the Supreme Court of British Columbia on Thursday naming LayerZero Labs Ltd., LayerZero Labs Canada Inc., and co-founder Bryan Pellegrino as defendants.
The legal document points to claims of negligence, negligent misrepresentation, and defamation connected to the April 18 security breach involving 116,500 rsETH, valued at approximately $292 million at the time.
“The security incident did not stem from any flaw in KelpDAO’s architecture,” the civil complaint asserts. “Instead, it originated from a breakdown in LayerZero’s own security framework.”
The court filing asserts that LayerZero evaluated and signed off on the single-verifier network, or DVN, setup utilized by the targeted Unichain bridge.
Evercrest maintains that LayerZero communicated in writing on February 2, 2024, stating there was “no issue” with adopting the default DVN configuration. Furthermore, on March 21, 2024, LayerZero instructed Evercrest to implement the exact same 1-of-1 setup utilized by another cross-chain bridge.
The lawsuit details that LayerZero previously characterized its DVN infrastructure as possessing multi-region redundancy alongside monitoring and notification systems. As stated in the claim, LayerZero assured partners that if a DVN became compromised, the worst possible outcome would be failing to validate a message accurately.
LayerZero Issued Warning to USDT0
Evercrest contends that LayerZero never cautioned them that a 1-of-1 setup relying on LayerZero’s proprietary DVN presented any vulnerability, nor did they recommend employing multiple DVNs. According to the document, LayerZero had already alerted another developer, USDT0, regarding the dangers associated with default DVN setups prior to the hack.
The exploit took place on April 18 around 17:35 UTC, per the lawsuit. Evercrest asserts that an unauthorized actor managed to infiltrate LayerZero’s security infrastructure after deploying malware onto a LayerZero developer’s personal machine via social engineering tactics.
Evercrest noted that the breach derailed KelpDAO’s stablecoin initiatives, ultimately leading to the discontinuation of its sbUSD project following the incident. Additionally, Evercrest has initiated the migration of rsETH to an alternative cross-chain security standard.
The litigation also addresses LayerZero’s public statements in the aftermath. Evercrest challenges LayerZero’s assertion that the chosen setup directly violates its suggested multi-DVN framework, pointing out that Pellegrino publicly blamed the protocol itself for opting for a 1-of-1 configuration.
Pellegrino pushed back against the accusations. “These claims remain entirely baseless,” he remarked on X, affirming his intention to mount a vigorous defense.
Evercrest demands financial restitution for negligent misrepresentation, negligence, and defamation, along with punitive and aggravated damages. The organization also highlights that KelpDAO users have pulled out upwards of $650 million in funds since the exploit occurred.
Originally published at https://www.theblock.co/news/regulation/2026-09-25-kelpdao-sues-layerzero-claims-it-endorsed-setup-used-in-292-million-rseth-exploit-416361.
