Kelp DAO Sues LayerZero and Co‑Founder Over $292 Million rsETH Exploit

Kelp DAO has taken legal action against LayerZero and its co‑founder Bryan Pellegrino, claiming the cross‑chain messaging protocol’s design and response allowed a $292 million theft of its rsETH token.

Details of the rsETH Bridge Attack

On April 18, attackers exploited the LayerZero bridge used by Kelp DAO to move its liquid restaking token, rsETH. By compromising remote procedure call (RPC) nodes, the attackers fed false data to the bridge’s verifier, causing it to approve a burn of rsETH that never occurred. The link" href="/prices/ethereum">Ethereum contract then released the corresponding funds, resulting in the loss of roughly 116,500 rsETH.

Impact on the DeFi Ecosystem

The breach quickly affected broader DeFi metrics. Aave’s total value locked fell by $8.45 billion within two days, and overall DeFi TVL across major chains declined.

Kelp DAO’s Claims Against LayerZero

Kelp DAO alleges that LayerZero concealed technical flaws and failed to prevent the attackers from infiltrating its security infrastructure. The DAO also states that LayerZero publicly blamed Kelp for months, while LayerZero maintains that it reviewed and endorsed the bridge’s deployment in writing.

Legal and Recovery Efforts

Kelp DAO’s lawsuit seeks to hold LayerZero and Pellegrino accountable for the damages to Kelp and the wider DeFi ecosystem. The DAO notes that recovery of the stolen assets is also proceeding through the courts; a U.S. court order in May blocked the Arbitrum DAO from moving 30,766 ETH frozen from the hacker.

Future Steps for Kelp DAO

Following the exploit, Kelp DAO is transitioning its rsETH bridge to a more secure cross‑chain standard, specifically naming Chainlink CCIP as a replacement.