Evercrest Technologies, the company behind liquid restaking protocol Kelp DAO, has sued LayerZero Labs and its co-founder and CEO Bryan Pellegrino in the Supreme Court of British Columbia over the April exploit of the rsETH bridge. The notice of civil claim is dated September 24, and Kelp published it late Thursday, per CoinDesk and Unchained.
The April 18 attack released 116,500 rsETH — roughly $292 million at the time — that was not backed by any deposits. LayerZero has linked the attack to North Korea's Lazarus Group, an attribution that remains the company's assessment rather than an officially confirmed finding.
What the Filing Alleges
The suit alleges negligent misrepresentation, negligence and defamation, and seeks damages including aggravated and punitive damages on the defamation claim. It names no figure but says the exploit and LayerZero's public statements have inflicted "tens of millions of dollars of damages" on Evercrest.
The case turns on how the bridge was verified. LayerZero relies on Decentralized Verifier Networks (DVNs) to confirm that tokens were locked or burned on one chain before matching tokens are minted on another. The Unichain bridge hit in April required approval from a single DVN — one run by LayerZero itself.
Evercrest alleges LayerZero backed that 1-of-1 setup in written messages in February 2024, March 2024 and January 2025, at one point telling it to copy the configuration of another single-verifier bridge. The filing also alleges LayerZero warned another developer, USDT0, about risks in its default configurations but never warned Kelp.
According to the claim, the intrusion began on March 6, when an attacker used social engineering to install malware on a LayerZero developer's computer, then tampered with LayerZero's RPC nodes and hit an outside RPC provider with a denial-of-service attack — leading LayerZero's DVN to approve a forged message.
LayerZero's Position
LayerZero's April 19 statement said it and others "previously communicated best practices around DVN diversification to KelpDAO," and that Kelp's setup "directly contradicts the multi-DVN redundancy model that LayerZero has consistently recommended to all integration partners." The company has maintained that Kelp first used multi-verifier defaults and moved to a single verifier on its own — a point the filing disputes. LayerZero's May incident report said its DVN "will refuse to sign as the sole required attestor on any channel."
"The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly," Pellegrino wrote on X.
The Defamation Claim and the Fallout
Pellegrino is sued personally over posts on X and Telegram, and the claim also targets the April 19 statement. Evercrest says users have withdrawn more than $650 million from Kelp since the exploit and that it posted 2,000 ETH of its own to help restore rsETH's backing. Kelp said in May it would migrate rsETH to Chainlink's cross-chain protocol; its latest statement says that migration is underway. CryptoPotato and Cryptopolitan also covered the filing.
Whatever the court decides, the suit is a marker for infrastructure liability: a protocol operator is now arguing in court that the bridge provider that reviewed and connected its deployment shares responsibility for a nine-figure exploit. Until there is a ruling or settlement, the allegations on both sides remain exactly that — allegations.
TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.