KelpDAO, a decentralized liquid staking protocol on Ethereum, has filed a civil claim against LayerZero and its co-founder Brian Pellegrino, alleging the company’s cross-chain bridge protocol failed to disclose critical security weaknesses. The lawsuit follows a $292 million exploit on April 22, which drained 116,500 rsETH tokens and triggered a broader liquidity crisis in decentralized finance (DeFi), erasing $20 billion in total value locked (TVL).
According to the complaint, the attack—attributed to a North Korean hacking group—exploited flaws in LayerZero’s infrastructure, including a failure to disclose inherent risks in its universal bridge technology. KelpDAO claims the breach allowed unauthorized access to its security systems, enabling the theft. The protocol has since migrated its rsETH bridge to a more secure cross-chain standard but insists LayerZero bears responsibility for the incident.
Pellegrino dismissed the lawsuit as meritless, stating he would defend himself and LayerZero in British Columbia’s courts. The dispute centers on accountability for one of the largest DeFi exploits of 2026, with KelpDAO arguing the attack underscored broader vulnerabilities in cross-chain protocols. The aftermath included liquidity withdrawals from major DeFi platforms like Aave, which reportedly borrowed $300 million to stabilize withdrawals.
The case highlights ongoing debates over transparency in DeFi security, as protocols continue to adapt to high-profile breaches that have reshaped trust in decentralized finance.
