The world of decentralized finance (DeFi) was shaken once again this year when KelpDAO, a popular liquid restaking protocol, lost roughly $292 million in an exploit that targeted its cross-chain bridge. Now, the company behind KelpDAO is fighting back in court.
Evercrest Technologies, the firm that operates KelpDAO, has filed a civil claim against LayerZero Labs and several related entities, including co-founder Bryan Pellegrino. The lawsuit centers on the April 2025 bridge exploit that drained 116,500 rsETH tokens. Here is what the dispute is about, why it matters for the broader DeFi ecosystem, and what users can learn from it.
What Happened During the KelpDAO rsETH Exploit?
In April 2025, attackers exploited a vulnerability in the bridge configuration used by KelpDAO to move rsETH, a restaked version of staked ETH, between different chains. A bridge in crypto is essentially a piece of infrastructure that lets tokens move from one blockchain to another. Think of it like a currency exchange booth at an airport: convenient, but it has to be trustworthy.
The attackers managed to siphon out 116,500 rsETH tokens, which were worth around $292 million at the time of the incident. Restaking tokens like rsETH represent staked ETH that is being used again to secure other networks, earning users extra yield on top of standard staking rewards.
The scale of the loss makes this one of the largest bridge-related incidents in recent memory, putting it alongside other infamous exploits that have plagued the DeFi sector over the years.
Why Is KelpDAO Suing LayerZero?
Evercrest Technologies alleges that LayerZero reviewed and formally endorsed the bridge configuration that was later blamed for the attack. In other words, KelpDAO is claiming that the security assessment and approval from LayerZero gave the project confidence to operate the bridge in a specific way, and that this approval ultimately contributed to the vulnerability being exploited.
The civil claim names LayerZero Labs along with co-founder Bryan Pellegrino and related entities. According to Evercrest, LayerZero’s involvement was not just passive; the company allegedly validated the technical setup that failed.
It is important to note that these are allegations at this stage. Nothing has been proven in court, and LayerZero has not yet been found liable for any wrongdoing. Legal proceedings will determine whether the claims hold up.
Understanding the Blame Game in DeFi
Bridge exploits are particularly contentious because multiple parties are usually involved in designing, auditing, and approving the underlying technology. When something breaks, it is rarely clear who should bear the responsibility. Audit firms, protocol developers, and infrastructure providers like LayerZero all play a role, and each may point fingers at the others.
This lawsuit highlights a growing tension in the DeFi space: as protocols grow larger and hold more user funds, the question of liability becomes harder to ignore. Traditional finance has clear legal frameworks for this. DeFi, being largely borderless and pseudonymous, is still figuring it out.
What Is LayerZero’s Role in the KelpDAO Bridge?
LayerZero is an omnichain interoperability protocol, which is a fancy way of saying it provides the messaging infrastructure that allows different blockchains to communicate with each other. Many bridges and cross-chain applications are built on top of LayerZero’s technology.
Because LayerZero sits at a foundational layer of the cross-chain stack, its endorsement of a particular bridge configuration carries significant weight. Projects often rely on LayerZero’s reviews to ensure that integrations meet certain security standards. If those reviews are later shown to be flawed, the fallout can be enormous, both financially and reputationally.
Why This Lawsuit Matters for DeFi Users
Even if you have never used KelpDAO or rsETH, this case has ripple effects across the entire DeFi ecosystem. Here is why everyday crypto users should pay attention:
- Accountability is being tested. This is one of the first major attempts to hold an infrastructure provider legally responsible for a bridge exploit. The outcome could set a precedent.
- Bridge designs may change. Depending on how the case unfolds, protocols might become more cautious about which infrastructure providers they work with and how they document security reviews.
- User trust is fragile. Every major exploit erodes confidence in DeFi. Lawsuits like this can either rebuild trust by showing that there are consequences, or deepen skepticism by highlighting how much can go wrong.
How to Protect Yourself from Bridge Exploits
While the legal battle plays out in court, users can take practical steps to reduce their exposure to bridge-related risks:
1. Limit Your Exposure to Bridges
The simplest approach is to keep your funds on a single, well-established chain rather than moving them across multiple networks. Every bridge is a potential point of failure.
2. Use Hardware Wallets for Long-Term Holdings
If you are holding significant amounts of crypto, consider storing them in a Ledger hardware wallet. Hardware wallets keep your private keys offline, making them far less vulnerable to remote exploits that target bridges and smart contracts.
3. Diversify Across Reputable Platforms
Instead of parking all your assets on a single protocol, spread them across trusted exchanges and platforms. Well-regulated exchanges like Kraken or Bitvavo offer additional layers of security and insurance that purely on-chain protocols cannot match.
4. Monitor Protocol Audits and Reviews
Before interacting with any DeFi protocol, check whether it has been audited by reputable firms and whether its infrastructure dependencies, like LayerZero, have a clean track record.
The Road Ahead
The KelpDAO versus LayerZero lawsuit is more than just a legal dispute. It is a stress test for how the DeFi industry handles accountability when things go catastrophically wrong. With $292 million on the line, both sides have strong incentives to fight aggressively, and the result could shape how bridges are designed, audited, and insured for years to come.
For now, the case serves as a stark reminder that bridges remain one of the riskiest parts of DeFi. Whether the courts will bring clarity or further confusion remains to be seen, but the entire crypto industry will be watching closely.
