LayerZero Security Model Challenged in $292M rsETH Lawsuit as Users Exit

Summary

• KelpDAO filed a civil claim against LayerZero Labs and CEO Bryan Pellegrino on September 24, 2026, in British Columbia over the rsETH bridge exploit.
• The suit alleges negligence and defamation tied to the April incident that drained 116500 rsETH worth $292 million.
• Nearly $15 billion has exited LayerZero-linked protocols as users question cross-chain security practices.

KelpDAO sued LayerZero Labs and CEO Bryan Pellegrino. They filed the civil claim in British Columbia on September 24, 2026. The suit accuses both of negligence and defamation over the rsETH bridge exploit.

KelpDAO says LayerZero reviewed and endorsed the bridge setup that later got hacked. This marks the first formal legal action from the April incident that drained 116500 rsETH.

The lawsuit arrives as nearly $15 billion flows out of LayerZero-powered bridges and apps. Users doubt the security of cross-chain setups after the exploit. Those claims have not been proven in court.

Context

Attackers drained funds from the restaking protocol in April. They hit it through a compromised bridge setup. KelpDAO had used LayerZero's messaging layer for cross-chain transfers.

LayerZero calls itself a secure omnichain solution. The April loss ranked among the bigger hits in restaking and sparked quick questions about bridge configs and audits.

Details

KelpDAO accuses LayerZero and Pellegrino of failing to stop the config flaw in the British Columbia filing. The complaint adds defamation claims over public statements after the event. Approved sources confirm the suit names both the company and its chief executive.

LayerZero's security model uses decentralized verification and endpoint configs chosen by each protocol. The lawsuit claims LayerZero reviewed and endorsed KelpDAO's specific setup. That claim could push other projects to check their own LayerZero setups if it holds up.

The rsETH exploit fits a pattern of cross-chain failures. Those have cost users billions in recent years. No technical details have confirmed yet whether code flaws, operational errors, or both caused the breach.

"Kelp DAO sued LayerZero and co-founder Bryan Pellegrino over the $292M rsETH bridge exploit, alleging negligence and defamation."

, Source shattered.io

Reaction

Market data shows accelerated outflows from LayerZero ecosystems since the April exploit. The $15 billion exit figure reflects user moves to other bridges or on-chain withdrawals. No major protocol has announced a full migration away from LayerZero, but volume shifts show caution.

Community talks center on what this means for cross-chain security. Developers still debate whether current verification methods protect funds well during big transfers.

The suit stays in early stages with no court rulings yet. LayerZero has not released a detailed public response to the British Columbia claim.

The next milestones to watch include any response filing from LayerZero Labs, potential discovery of additional technical evidence, and whether other affected protocols pursue similar actions.