KelpDAO sues LayerZero over $292 million hack

KelpDAO sues LayerZero over $292 million hack
KelpDAO sues LayerZero over $292 million hack

​KelpDAO has filed a lawsuit against cross-chain protocol LayerZero and its co-founder Brian Pellegrino over the $292 million hack in April. The project claims vulnerabilities in LayerZero's technology and shortcomings in its security allowed attackers to steal 116,500 rsETH.

The attack occurred on April 22 and became the largest crypto hack of 2026. Its impact spread across the DeFi market and triggered a sharp increase in user demand for withdrawals.

According to KelpDAO, LayerZero failed to disclose existing risks in its technology and did not prevent its security infrastructure from being compromised. The lawsuit also names Pellegrino personally, and he has already called the claims baseless.

KelpDAO and LayerZero blame each other

The developers said the hack was a direct result of LayerZero's shortcomings. The project also accused the company and its co-founder of trying to shift responsibility for the incident onto KelpDAO in the months following the attack.

Pellegrino confirmed receiving notice of a civil lawsuit filed by Evercrest, which is affiliated with KelpDAO, in British Columbia. He said he intends to defend his position in court in Vancouver and considers the allegations to be without merit.

The attack has reportedly been linked to a North Korean hacking group. The attackers drained 116,500 rsETH worth around $292 million from the project's cross-chain infrastructure, which at the time held nearly one-fifth of all tokens in circulation.

Following the incident, KelpDAO said it had introduced additional measures to protect user assets. In particular, the project migrated the rsETH bridge to a new cross-chain security standard.

Hack triggers major outflows from DeFi

The attack also affected other major DeFi protocols. Amid increased user demand for withdrawals, leading lending protocol Aave had to secure around $300 million in additional liquidity.

In the following days, total value locked in DeFi fell by around $20 billion. Experts, including JPMorgan analysts, cited the incident as an example of the persistent infrastructure risks facing decentralized finance.

Overall, the second quarter of 2026 set a record for the number of successful attacks on crypto projects. Researchers recorded 83 incidents over the three-month period, with total losses of around $755 million, led by the attacks on KelpDAO and Drift Protocol.

However, the amount stolen remained well below the historical peak. By comparison, total crypto industry losses from hacks reached $3.56 billion in the fourth quarter of 2020.

Earlier, we reported that a Gnosis Safe wallet owner lost $7.8 million in crypto due to a vulnerability in a third-party smart contract. An attacker bot front-ran the user's transaction and drained around 2,900 rsETH.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.