KelpDAO Sues LayerZero and CEO Over $292M rsETH Bridge Exploit

$292 million. That is the figure at the center of a lawsuit filed today by KelpDAO against LayerZero Labs and its co-founder and CEO Bryan Pellegrino, stemming from an April 2026 exploit of KelpDAO's rsETH bridge. The attack is the largest single exploit recorded so far in 2026.

KelpDAO's core allegation is pointed: LayerZero endorsed the bridge configuration before the attack occurred. In other words, KelpDAO claims it did not act unilaterally when building on top of LayerZero's cross-chain messaging infrastructure. The protocol got a green light, and then lost nearly $300 million. That sequence, if proven, is the foundation of the legal argument.

Pellegrino is not impressed. He has publicly dismissed the lawsuit as meritless, a response that signals LayerZero intends to contest the claim aggressively rather than settle quietly. The defense posture LayerZero is likely to take is already visible in the logic of the situation: cross-chain messaging protocols provide infrastructure, not guarantees. A builder using that infrastructure assumes responsibility for their own implementation. Endorsing a setup, LayerZero will likely argue, is not the same as warranting it against all possible attack vectors. Causation in bridge exploits is notoriously difficult to pin down. The vulnerability may have lived in KelpDAO's specific code, its oracle configuration, or its validator set, none of which LayerZero controls.

The legal terrain here is genuinely unsettled. Crypto litigation targeting protocol developers for third-party implementations is still rare enough that there is almost no clean precedent to cite. Bridge exploits have produced catastrophic losses before: the Ronin bridge hack in March 2022 cost $625 million, Poly Network lost $611 million in 2021, and the Nomad bridge collapsed for $190 million in August 2022. None of those cases produced a successful lawsuit against the underlying messaging or infrastructure layer. KelpDAO is trying something that the industry has mostly avoided, holding a protocol and its named founder personally liable for how a downstream project built on top of it.

That distinction matters. rsETH is KelpDAO's liquid restaking token, and the bridge that was exploited was KelpDAO's own deployment using LayerZero's messaging rails. LayerZero's protocol has processed hundreds of billions in cross-chain volume and powers dozens of major bridges and applications. If courts were to find that endorsing a third-party integration creates legal liability for subsequent exploits, the implications for protocol developers across the industry would be severe. Developers would face pressure to either stop providing integration guidance entirely or assume insurance-like exposure every time they help a partner ship.

At the same time, KelpDAO's argument is not frivolous on its face. If LayerZero's team reviewed the bridge architecture, signed off on it, and that review was materially relied upon by KelpDAO in deciding to launch, there is at least a colorable negligent misrepresentation claim. The strength of that argument depends entirely on what "endorsed" means in practice: was it a formal security audit, a Slack message from a developer, or something in between? That factual record will determine whether this case survives early motions to dismiss.

For the broader market, the lawsuit lands at a moment when cross-chain security is already under intense scrutiny. Bridge exploits have accounted for a disproportionate share of total crypto losses across every year since 2021. The $292 million rsETH incident alone represents a material fraction of all DeFi losses in 2026. Litigation is becoming a more common response as projects exhaust on-chain recovery options and look to legal systems for recourse.

The case will be one to watch closely. A ruling favorable to KelpDAO would reshape how protocol developers engage with integrators. A dismissal would reinforce the existing norm: builders bear the risk of what they build, regardless of who helped them design it.