Evercrest Technologies, the company developing liquid restaking protocol Kelp DAO, has sued LayerZero Labs and its co-founder and CEO Bryan Pellegrino in the Supreme Court of British Columbia over the April exploit of rsETH’s LayerZero bridge. The notice of civil claim is dated Sept. 24, and Kelp published it late Thursday.
In its statement, Kelp said the exploit was a direct result of LayerZero’s failures and said LayerZero had reviewed and endorsed its deployment in writing. The April 18 attack released 116,500 rsETH, worth about $292 million at the time, that was not backed by any deposits. LayerZero later tied the attack to North Korea’s Lazarus Group.
What the lawsuit alleges
The claim alleges negligent misrepresentation, negligence, and defamation, and seeks damages, including aggravated and punitive damages tied to the defamation claim. It does not specify a damages figure, but says the exploit and LayerZero’s public statements caused Evercrest tens of millions of dollars in losses.
The dispute over the bridge configuration
The case turns on how the bridge was verified. LayerZero uses Decentralized Verifier Networks, or DVNs, to confirm that tokens were locked or burned on one chain before corresponding tokens are minted on another.
The Unichain bridge hit in April required approval from only one DVN, operated by LayerZero. Evercrest says LayerZero supported that 1-of-1 setup in written messages sent in February 2024, March 2024, and January 2025. In one exchange, it says LayerZero told the team to copy the configuration of another single-verifier bridge.
The filing also says LayerZero warned another developer, USDT0, about risks in its default configurations but never warned Kelp. LayerZero’s April 19 statement said it and others had previously communicated best practices on DVN diversification to KelpDAO.
How the breach allegedly happened
According to the filing, the breach began on March 6, when an attacker used social engineering to install malware on a LayerZero developer’s computer. The attacker then tampered with LayerZero’s RPC nodes and launched a denial-of-service attack against an outside RPC provider, leading LayerZero’s DVN to approve a forged message.
Defamation claims against Pellegrino
Pellegrino is being sued personally over posts on X and Telegram. The claim also points to LayerZero’s April 19 statement, in which the company said on its blog that Kelp’s setup “directly contradicts the multi-DVN redundancy model that LayerZero has consistently recommended to all integration partners.”
Evercrest says users have withdrawn more than $650 million from Kelp since the exploit, based on current ETH prices, and says it contributed 2,000 ETH to help restore rsETH backing.
Responses from LayerZero and Kelp
“The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly,” Pellegrino wrote on X on Thursday.
LayerZero has maintained that Kelp initially used multi-verifier defaults and later switched to a single verifier on its own, a point the filing disputes. In its May incident report, LayerZero said its DVN will refuse to sign as the sole required attestor on any channel.
Kelp said in May that it would migrate rsETH to Chainlink’s cross-chain protocol, and its latest statement says that migration is underway. “We look forward to having our day in court,” Kelp said.