KelpDAO Sues LayerZero for $292 Million After Largest Exploit of 2026

The cross-chain lending protocol accuses LayerZero and co-founder Bryan Pellegrino of failing to disclose critical weaknesses before a hack drained nearly $300 million in user funds.

KelpDAO, a cross-chain restaking protocol, has filed a lawsuit against LayerZero Labs and its co-founder Bryan Pellegrino, alleging negligence and misrepresentation that led to a $292 million exploit in what has become the largest crypto hack of 2026. The complaint centers on LayerZero's messaging infrastructure, which KelpDAO used to bridge its rsETH token across multiple blockchains.

According to court filings, KelpDAO claims LayerZero endorsed its bridge setup and provided technical guidance, but failed to disclose known vulnerabilities in the cross-chain messaging protocol. The exploit occurred when attackers manipulated the bridge logic to mint unauthorized rsETH tokens on destination chains, draining liquidity pools and leaving thousands of users unable to redeem their staked Ethereum positions.

LayerZero CEO Bryan Pellegrino has publicly dismissed the lawsuit as 'meritless,' stating on social media that his company provided only infrastructure and that security responsibility rests with protocols building on top of it. He pointed to LayerZero's public documentation, which he says clearly outlines security assumptions and recommends additional safeguards for high-value bridges.

The incident highlights growing tensions over liability in the cross-chain ecosystem, where multiple parties—bridge operators, messaging protocols, and frontend applications—share technical responsibilities but often dispute legal accountability when exploits occur. Previous bridge hacks, including the $600 million Ronin exploit in 2022, triggered similar finger-pointing between infrastructure providers and the protocols relying on them.

For ordinary DeFi users, the lawsuit raises urgent questions about the safety of bridging assets between blockchains. Even when a protocol appears to follow best practices and receives technical endorsement from infrastructure partners, hidden vulnerabilities can persist. Investors who bridged assets to KelpDAO's supported chains found their positions frozen immediately after the exploit, with recovery prospects still unclear.

The $292 million loss represents roughly 18% of all funds stolen in crypto hacks during 2026, according to blockchain security firm PeckShield. KelpDAO has suspended all bridging operations while conducting a forensic review, and affected users have organized a creditor committee to negotiate potential compensation. The protocol's native governance token has fallen 73% since the exploit was disclosed.

Legal experts note that the outcome of this case could set important precedent for how courts allocate responsibility in multi-layer blockchain systems. If KelpDAO prevails, infrastructure providers like LayerZero may face pressure to conduct more rigorous audits of downstream implementations or limit endorsements of third-party integrations. A ruling in LayerZero's favor could reinforce caveat emptor principles, placing the burden of security verification squarely on protocols and their users.