KelpDAO LayerZero Lawsuit: Who Pays When a $292M Bridge Fails?

In April 2026, about $292 million worth of a token called rsETH was drained from KelpDAO’s bridge, which was built on LayerZero. On 25 September 2026, CoinDesk and The Block reported that the company behind KelpDAO had sued LayerZero and its co-founder in Canada.

The case asks a question every holder of a bridged or wrapped token should understand: when a bridge fails, who pays? This is education, not legal or financial advice, and we don’t take a side in the lawsuit. CoinDesk discloses that it is owned by Bullish and that its staff may receive Bullish stock as pay.

What happened to KelpDAO’s rsETH bridge?

KelpDAO is what CoinDesk calls a liquid staking protocol. You put in ether and get back a token, rsETH, that stands for your share. To use rsETH on other blockchains, Kelp ran a bridge: a set of contracts and services that lets a token appear on one chain because it is locked or recorded on another. Kelp’s bridge was built on LayerZero, whose system passes messages between blockchains.

LayerZero’s incident report and CoinDesk both put the loss at about 116,500 rsETH, worth about $292 million at the time. The sources disagree on the exact day: LayerZero’s report says 18 April, while CoinDesk’s lawsuit story says 22 April. LayerZero says no other apps on its system were hit. CoinDesk reported that Kelp says its core contracts weren’t touched and that it paused the bridge shortly after the drain.

Who blamed whom after the exploit?

The argument is about verifiers. When a message crosses a LayerZero bridge, a verifier checks that it is real before the other side acts on it. LayerZero calls these verifiers DVNs. An app can require one verifier to sign off, or several independent ones.

Point	LayerZero’s account	Kelp’s account
Who chose the setup?	Kelp “chose to utilize a 1/1 DVN configuration” (CoinDesk)	The setup “reflects LayerZero’s documented default configuration” (CoinDesk)
What made the attack possible?	“The affected OApp’s single-verifier configuration” (incident report)	The verifier that was compromised was built and run by LayerZero, not Kelp
What changed afterward?	LayerZero’s verifier now refuses to sign as the only required checker on any channel	Kelp planned to move rsETH to Chainlink CCIP (The Block)

On who did it, LayerZero linked the attack, with what it called preliminary confidence, to North Korea’s Lazarus Group, as CoinDesk reported. Its later report credits that attribution to outside security firms. That is an attribution by a company and security firms, not a court finding. Kelp’s move to Chainlink is its own choice, and we are not saying either system is better; our Chainlink explainer covers what CCIP is.

What does the KelpDAO lawsuit claim?

The Block reports that Evercrest Technologies, the company behind KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia. It names LayerZero Labs Ltd., LayerZero Labs Canada Inc. and co-founder Bryan Pellegrino. We could not open the filing itself, so the details below come from the news reports.

CoinDesk describes the claim as alleging “a failure to disclose weaknesses and risks inherent in LayerZero’s own technology.” The Block reports it pleads negligent misrepresentation, negligence and defamation, seeks aggravated and punitive damages, and alleges LayerZero “reviewed and endorsed” Kelp’s single-verifier setup. These are allegations.

Pellegrino’s reply, as quoted by CoinDesk, was short: “The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.” The court has not ruled on any of it.

What does a bridge lawsuit mean for your money?

Three points come out of this story:

1. A bridged token is only as good as the bridge behind it. What you hold on the far side depends on the bridge doing its job. If it is tricked into releasing tokens it shouldn’t, the backing can come up short.
2. The setup can matter as much as the code. This whole fight is about how many independent checkers had to sign off, and who chose that number. You can’t see that from a wallet or a price chart.
3. Who pays when it fails is an open question. That is exactly what the lawsuit asks, and there is no answer yet.

A worked example: how a bridge shortfall happens

Here is a made-up example to make it concrete.

1. A project locks 100 coins in a vault on Chain A.
2. Its bridge lets 100 matching tokens exist on Chain B, one per coin in the vault. You hold 10 of them.
3. An attacker fools the single checker into approving a fake message, and 20 coins leave the vault.
4. There are still 100 tokens on Chain B, but only 80 coins back them.

The question is who covers the gap of 20. Depending on terms, insurance and, in some cases, a court, it could be the project, the company behind the bridge, or the holders. If the checkpoint had needed several independent checkers to agree, an attacker would have had more parties to fool. That doesn’t make any setup risk-free. It changes how many things have to go wrong at once.

What are the gaps in this story?

• We couldn’t open the court filing, so the claim details come from news reports.
• The claim is Kelp’s side; LayerZero’s co-founder calls it meritless.
• The sources give different attack dates, 18 or 22 April.
• The North Korea link is an attribution, not a court finding.
• LayerZero’s report and Kelp’s statements are each company’s own account.
• The dollar figure is what the tokens were worth at the time.

To be fair to LayerZero: it says apps choose their own settings, that it recommended several verifiers, and that apps with that kind of setup weren’t affected. To be fair to Kelp: it says the setup was LayerZero’s default, and the checker that failed was LayerZero’s own. Both can be argued, which is why it is in front of a judge.

What to watch next, and what would change this

1. LayerZero’s formal response to the claim in court.
2. Any ruling from the Supreme Court of British Columbia.
3. What Kelp says about rsETH’s backing after the exploit.
4. Whether other bridge providers change their default settings.
5. Whether other projects hit by bridge attacks bring similar claims.

If the filing, once public, reads differently from the news reports, the filing wins. If a court finds Kelp chose the setup against LayerZero’s advice, the “who pays” answer could tilt one way; if it finds LayerZero approved or pushed it, the other. The two sides could also settle privately.

Three bridge questions for your own tokens

1. For each token you hold that came from another chain, which bridge does it use, and how many independent checkers must sign off? Look in the project’s docs or security page. If you can’t find it, that is an answer too.
2. Who runs that bridge’s checks, and what do the project’s terms say happens if it fails? Write down in one line who you think would cover a gap, and where it says so.
3. How much of your crypto rides on any one bridge or wrapped token? Holding a coin on its home chain has its own trade-offs, so this is about knowing your number, not hitting a target.

Exchange risk works on the same logic; our look at why Bitget users couldn’t withdraw for 8 days covers the custody side. A token on one chain can depend on a checkpoint you can’t see on another, so when a bridge headline breaks, check whether any of your tokens cross it.