KelpDAO just sued LayerZero for $292M over the April rsETH hack. This isn't just another exploit story — it's the first major legal test of who pays when DeFi infra breaks.
The Setup:
April 18, 2026: Lazarus Group drains 116,500 $rsETH (~$292M) from Kelp's bridge
Sept 24: Kelp files in BC court, names LayerZero Labs + CEO Bryan Pellegrino personally
Kelp's Argument:
• LayerZero reviewed and endorsed their bridge setup in writing
• LayerZero failed to disclose risks in their own tech
• LayerZero's security infra got infiltrated, enabling the attack
LayerZero's Defense:
• Calls it "meritless"
• Blames Kelp's 1-of-1 DVN setup (single verifier)
• Says they'll fight it in Vancouver
Here's the kicker: 47% of ~2,665 LayerZero apps ran the same 1-of-1 setup when the hack happened. If half the ecosystem used it, was this really just Kelp's mistake?
LayerZero only banned 1-of-1 setups after the exploit. Kelp has since migrated $rsETH to Chainlink CCIP.
This case will set the first legal precedent for DeFi infrastructure liability. No quick settlement expected — Kelp wants its day in court.
Alpha: Always check how many verifiers secure your bridges. One weak checkpoint = millions gone.
Who wins this? Kelp or LayerZero?
The Setup:
April 18, 2026: Lazarus Group drains 116,500 $rsETH (~$292M) from Kelp's bridge
Sept 24: Kelp files in BC court, names LayerZero Labs + CEO Bryan Pellegrino personally
Kelp's Argument:
• LayerZero reviewed and endorsed their bridge setup in writing
• LayerZero failed to disclose risks in their own tech
• LayerZero's security infra got infiltrated, enabling the attack
LayerZero's Defense:
• Calls it "meritless"
• Blames Kelp's 1-of-1 DVN setup (single verifier)
• Says they'll fight it in Vancouver
Here's the kicker: 47% of ~2,665 LayerZero apps ran the same 1-of-1 setup when the hack happened. If half the ecosystem used it, was this really just Kelp's mistake?
LayerZero only banned 1-of-1 setups after the exploit. Kelp has since migrated $rsETH to Chainlink CCIP.
This case will set the first legal precedent for DeFi infrastructure liability. No quick settlement expected — Kelp wants its day in court.
Alpha: Always check how many verifiers secure your bridges. One weak checkpoint = millions gone.
Who wins this? Kelp or LayerZero?
