Evercrest Technologies, the developer behind restaking protocol KelpDAO, has sued LayerZero Labs and its co-founder Bryan Pellegrino in the Supreme Court of British Columbia, alleging the interoperability provider repeatedly approved in writing the very bridge configuration it later blamed for enabling a $292 million exploit. The lawsuit, filed Wednesday, accuses LayerZero and Pellegrino of negligent misrepresentation, negligence and defamation, opening one of the most consequential legal disputes yet over who bears responsibility when cross-chain infrastructure fails.
A Single Point of Failure
The case centers on how LayerZero’s verifier network, known as a Decentralized Verifier Network or DVN, is supposed to work. In theory, these verifiers confirm that tokens have been locked on one blockchain before an equivalent amount is minted on another, preventing the kind of duplication that would let an attacker create assets out of thin air. KelpDAO, however, ran its bridge with a 1-of-1 verifier setup — a single point of confirmation rather than a distributed network of checks. Evercrest claims LayerZero directed and repeatedly signed off on this configuration.
The consequences of that design surfaced in April 2026. According to the facts laid out in the filing, an attacker planted malware on March 6 and executed the attack on April 18, falsely reporting that 116,500 rsETH tokens were locked on the Unichain network. Because there was no second verifier to catch the discrepancy, the false report went unchallenged, and the attacker was able to drain $292 million from KelpDAO’s restaking protocol. Bridges were paused within about an hour of the exploit being detected, and the protocol’s team later contributed 2,000 ETH in an attempt to restore rsETH’s backing. Decrypt’s reporting notes that more than $650 million has been withdrawn from the protocol since the attack — a sign of how deeply the incident shook user confidence even after emergency measures were taken.
Who Told Whom What
What makes this dispute unusual is the paper trail Evercrest says it can produce. The lawsuit alleges LayerZero not only approved the single-verifier setup but did so in writing, undercutting any argument that the configuration was an unauthorized shortcut taken by KelpDAO alone. Compounding the tension, another developer building on LayerZero’s infrastructure, USDT0, was reportedly warned about the risks of the same 1-of-1 configuration and chose to switch to its own independent verifier instead — a decision that, in hindsight, looks prescient.
LayerZero has since acknowledged, in public statements, that it recommended a multi-verifier model to all of its partners and conceded that allowing a single-verifier setup for high-value transactions was a mistake. Pellegrino has dismissed the lawsuit as meritless. No formal court response has been filed, and the allegations remain unproven; nothing in the case has been adjudicated.
What This Means for DeFi Infrastructure
The lawsuit is less about the mechanics of one exploit and more about a question the DeFi industry has largely avoided answering: when a bridge or messaging protocol advises a customer on security architecture, and that architecture fails, who is liable — the protocol that built the product, or the infrastructure provider that approved its design? LayerZero’s business model depends on other projects trusting its verifier recommendations. If a court finds that written approvals from an infrastructure provider create legal exposure when things go wrong, it could reshape how bridge providers document and hedge their advice to partners — potentially slowing down integrations or pushing providers toward more conservative, multi-verifier defaults across the board.
The stakes extend beyond this single case. Cross-chain bridges have been a recurring target for attackers precisely because they concentrate value and trust in a small number of verification steps, a pattern echoed in other major incidents this year, including the Bitget breach that made September the costliest month of 2026 and follow-up reporting on how that hack exploited spoofed transfers rather than stolen keys. As institutions increasingly build on tokenized infrastructure — from BlackRock and Ondo’s portfolio tokenization efforts to bank consortiums exploring tokenized deposits — the durability of the underlying bridges and verification layers becomes a systemic concern, not just a technical footnote.
What to Watch
Several developments will determine how this case unfolds and what it signals for the broader industry:
- Whether LayerZero files a formal response and how it characterizes its written communications with Evercrest
- Any additional documentation submitted by either party regarding the verifier configuration approvals
- How the Supreme Court of British Columbia handles jurisdiction and evidentiary questions given LayerZero’s Canadian and international entities
- Whether other protocols that used single-verifier setups face similar scrutiny or disclosure demands
- Continued withdrawal activity from KelpDAO as user confidence is tested against the ongoing litigation
Source: Decrypt
This content is for informational purposes only and does not constitute financial or investment advice.
Create a free account to comment and earn rewards.
Create account Log in