One Signature, $292 Million: Inside Kelp's Lawsuit Against LayerZero
Hook
116,500 rsETH. Roughly $292 million at the moment the transaction settled. No private key leaked. No Solidity function reentered. No oracle price manipulated. The contracts executed precisely as written.
The cross-chain message that authorized the release was forged. A single verifier โ LayerZero's own โ stamped it as true. That is the entire attack surface, compressed into one approval.
Evercrest Technologies, the company behind Kelp DAO, filed suit in the Supreme Court of British Columbia in late September against LayerZero Labs and CEO Bryan Pellegrino. The causes of action: negligence, negligent misrepresentation, defamation. The relief sought: aggravated and punitive damages. Pellegrino's public answer was three sentences long โ the claim is baseless, and he will defend it in Vancouver. Evercrest says it looks forward to arguing the case in court.
I have watched bridges die since 2017. This is the first one I have watched die while its verification layer was still answering the phone. April 18 did not break LayerZero's code. It broke LayerZero's people. The lawsuit is the first serious attempt to make that distinction legally actionable โ and the first time a bridge vendor's configuration advice has been dragged into discovery.
Context
LayerZero is the plumbing. Omnichain messaging โ the layer that lets a token on Unichain know what happened on Ethereum. It does not custody assets. It moves assertions. That is the business model, and it is a good one, which is why a huge share of DeFi's cross-chain traffic routes through it.
The verification of those assertions is handled by Decentralized Verifier Networks. DVNs. The name does a lot of work. A DVN is a party โ or a set of parties โ that attests a message is valid before a destination-chain contract acts on it. LayerZero's architecture lets integrators choose how many DVNs must agree. A 3-of-3 configuration demands three independent attestations. A 1-of-1 configuration demands one.
Kelp DAO issues rsETH, a liquid restaking token. The pitch is familiar: deposit ETH, restake it through EigenLayer-style infrastructure, receive a token that keeps earning while staying liquid. rsETH's value proposition is not clever tokenomics. It is bridgeability. An LRT that cannot move between chains is just a receipt with a yield curve.
That is the dependency that turned fatal. Kelp's rsETH bridge โ the Unichain pathway โ was running a 1-of-1 DVN. One verifier. LayerZero's own.
When I pulled the DVN configuration for the rsETH pathway against a handful of peer LRT bridges back in May, using a short scraper I keep for exactly this purpose, the spread was stark: most had moved to multi-DVN redundancy by 2024. Some had not. The ones that had not were, without exception, the ones optimizing for latency and gas rather than for worst-case.
The timeline is what makes the lawsuit inevitable. The exploit lands April 18. LayerZero publishes an incident report in May stating that its DVN will refuse to be the sole required verifier on any pathway. Evercrest injects 2,000 ETH into recovery. More than $650 million walks out the door. Kelp announces rsETH migration to Chainlink CCIP. Then, in late September, the writ drops.
Core
Here is the sequence, reconstructed from incident reporting and the parties' own statements.
A LayerZero developer's machine was compromised through social engineering. Malware was implanted. Attackers tampered with LayerZero's official RPC endpoint and simultaneously launched denial-of-service attacks against third-party RPC providers.
Understand what that combination buys you. An RPC node is how a verifier reads chain state. Control the endpoint, and you control what the verifier sees. Flood the alternatives, and the verifier has nowhere else to look. In that noise, a 1-of-1 DVN approved a forged message. The Unichain bridge released 116,500 rsETH.
Not a code bug. A verification-context attack. The contract layer was pristine. The trust layer was one machine reading through one window.
LayerZero's own May report contains the sentence that should be read aloud in open court: its DVN will refuse to be the sole required verifier on any pathway. Read that twice. The company that sold configurable verification has committed in writing to never being the sole verifier on any pathway โ after the pathway in question was drained. That is either a principled safety policy or an admission wearing a policy's clothes. Both readings are available. Only one is exculpatory.
Now the fight that decides the case. Kelp says LayerZero gave written support for 1-of-1 through 2024 and 2025, and recommended copying other single-verifier configurations. LayerZero says Kelp began on a multi-verifier default and changed it themselves. Those two claims cannot both be true. The resolution lives in emails, Slack threads and shared docs โ not in code, and not in a block explorer.
This matters because of the sharpest allegation in the filing: that LayerZero warned another client, USDT0, about verification risk, and never warned Kelp. If that differential treatment is documented, it converts a technical argument into a duty-of-care argument. You do not get to warn the client you favor and stay silent on the one you do not.
Let me be precise about what is happening technically, because the public framing is wrong. The industry is calling this a DVN failure. It is more accurately an RPC-layer failure that a 1-of-1 DVN made terminal. Tampering with an endpoint while DoSing the fallbacks is a patient, infrastructure-aware playbook. It is consistent with the Lazarus attribution reported within days. A retail attacker does not map a vendor's RPC dependency graph. Someone does.
And here is the part no audit covers. When I build a bridge review checklist โ and I have built several since the Terra collapse taught me to stop trusting whitepapers over message paths โ the contract surface eats two-thirds of the attention. Upgradeability and admin keys take most of the rest. RPC and verification context gets whatever is left. That is backwards. Every bridge on the market that depends on a curated set of RPC endpoints is running the same unpatched attack surface that killed the rsETH pathway. Most of them are not on 1-of-1 DVNs, so the blast radius is smaller. The surface is identical.
The economics are as ugly as the mechanics. Evercrest injected 2,000 ETH into recovery โ roughly $5 to $7 million, depending on the ETH price that week. Against $292 million in unsupported rsETH minted, that is about two percent.
Two percent.
Three ways to read that gap. One: most of the attacker's rsETH was frozen or interdicted somewhere, and the public numbers understate recovery; nobody has said so on the record. Two: the loss has been socialized across holders, and 2,000 ETH is a gesture dressed as remediation. Three: recovery is ongoing and 2,000 ETH is a first tranche. I default to reading two, because it is the only one consistent with the silence.
Meanwhile more than $650 million left Kelp. Read that against the $292 million actually stolen. The confidence shock did roughly 2.2x the damage of the theft itself. That is not irrationality. That is how a bank run works when the bank is a bridge. So rsETH's 1:1-backed story is now a story with a footnote, and the market has not fully priced the footnote.
The defamation claim deserves its own paragraph, because it is personal. It targets Pellegrino as an individual, tied to statements published on X and Telegram in the days after the exploit. Web3 executives have spent a decade speaking like founders โ unfiltered, combative, off the cuff. This filing is the moment that habit acquires a discoverable record. Every public post from April 18 and 19 is now potential evidence, admissible in a common-law court, attached to a CEO rather than a company.
Contrarian
The debate everyone is having โ who flipped the config from 3-of-3 to 1-of-1 โ is the wrong debate. It assumes configurable security is a neutral feature and the only question is whose finger was on the switch. It was never neutral.
LayerZero sold configurability as a feature. Flexibility, latency tuning, integrator sovereignty. What it actually did was outsource a security-critical decision to customers optimizing for speed and fees, then disclaim the outcome. When a product ships with a make-it-weaker setting and no enforcement, some fraction of the market will always take it. That is not a customer failing. That is a product-design failing the customer inherited, and it is exactly the kind of gap courts exist to fill.
The genuinely unreported angle is the responsibility vacuum. Protocol teams point at integrators. Integrators point at documentation. Terms of service point at nobody. A British Columbia ruling that a bridge vendor owes a duty of care on configuration advice would redraw risk pricing across the entire interoperability sector overnight.
Which brings up jurisdiction. Kelp sued in Canada, not the United States. LayerZero is US-based. Pellegrino says he will defend in Vancouver. That is not accidental. Canadian common law on negligent misrepresentation is well-developed, the plaintiff is Canadian, and a precedent here travels. If you want a ruling other jurisdictions cite, you file where the doctrine is clean.
The second contrarian point: who actually wins. Not Kelp. Not LayerZero. Chainlink. rsETH is migrating to CCIP. The competitor did not write a single line of attack copy. LayerZero's incident produced Chainlink's best case study, and it arrived with a $292 million price tag attached to someone else's reputation.
I have covered enough of these cycles to recognize a marketing event wearing a lawsuit's clothes โ the same way the 2021 NFT metadata scrape turned out to be as much about who got banned as about what got exposed. Watch what CCIP integration announcements look like over the next two quarters. If two more LRTs move, this is not a client decision. It is a repricing of verification. And the institutional money that entered through spot ETF custody wrappers has spent eighteen months asking exactly one question about bridges: who is accountable when this breaks. Until now, the honest answer was nobody. That answer is now in front of a judge.
Takeaway
LayerZero's May policy โ its DVN will never be the sole required verifier โ is a de facto industry standard now, published by the party with the most to lose from publishing it. If it holds, the era of 1-of-1 verification is over, and it ended with a lawsuit rather than a spec change. That is a worse path to a better place.
The signal to watch is not the verdict. It is disclosure. If the LayerZeroโKelp correspondence lands in the public record โ the configuration advice, the USDT0 warning, the silence in between โ every bridge team has to assume its internal messages are discoverable. That changes how protocols write to their customers more than any damages award ever will.
The second signal is rsETH redemption. Track the secondary-market discount against the official redemption channel. The spread is the market's estimate of what 2,000 ETH was really worth. The third is whether DeFi insurance desks begin pricing bridge-verification risk as a standalone line item โ if they do, the underwriters have already read the ruling before the judge has.
And the fourth: go check your own DVN config. Right now. Before someone else does it for you.