$292M Lawsuit Tests Bridge Vendor Liability for DeFi Code Endorsements

For legal and regtech professionals, this is a test of how courts allocate liability for smart-contract security failures when an infrastructure vendor allegedly specified the exact configuration later exploited. The claim pleads negligent misrepresentation, negligence, and defamation, including personal posts by CEO Bryan Pellegrino, and seeks aggravated and punitive damages. Discovery and rulings will shape vendor due diligence standards, executive communications risk, and cross-border DeFi litigation tactics.

Evercrest Technologies, the developer behind restaking protocol KelpDAO, has filed a notice of civil claim in the Supreme Court of British Columbia against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and LayerZero co-founder and CEO Bryan Pellegrino. The claim, filed on September 23, 2026, alleges that LayerZero endorsed in writing the exact bridge configuration it later blamed for the April 2025 exploit that drained $292 million from the protocol. The causes of action include negligent misrepresentation, negligence, and defamation, with Evercrest seeking aggravated and punitive damages over both the financial loss and Pellegrino's subsequent public statements.

“

For markets and token holders, the $292 million exploit raises questions about rsETH collateral and the resilience of restaking protocols.

The legal dispute centers on a 1-of-1 verifier architecture. Evercrest contends that its KelpDAO bridges ran with LayerZero's own verifier network as the sole party confirming that tokens had been locked on one chain before equivalent tokens were minted on another. According to the filing, LayerZero told Evercrest in February 2024 that its draft code was "good" and that there was "[n]o problem" using the default configuration. In March 2024, LayerZero allegedly directed Evercrest to use a 1-of-1 setup with LayerZero's own verifier. Then, in January 2025, LayerZero said that even if a verifier were compromised, the most it could do was fail to verify a message correctly. The claim states that LayerZero warned a separate developer, USDT0, about risks in its default verifier configurations in late 2024 or early 2025, prompting USDT0 to run its own verifier. Evercrest says it received no comparable warning.

The attack chain described in the claim began inside LayerZero's own environment. An attacker allegedly placed malware on a LayerZero developer's computer on March 6, 2025, then tampered with LayerZero's nodes so they fed false readings to the verifier. On April 18, 2025, the attacker disabled the third-party nodes the verifier also used, so the verifier was told 116,500 rsETH had been locked on Unichain when nothing had been locked. Because only one verifier was required, the tokens were minted without backing, resulting in the $292 million loss. Evercrest says it paused the bridges within about an hour and blocked a second attempt, limiting further damage.

LayerZero and Pellegrino have pushed back. Cointelegraph reports that Pellegrino dismissed the lawsuit as meritless, though the sources do not provide a detailed legal response. The personal naming of Pellegrino is notable because the suit alleges defamation over his posts on Telegram and X, meaning his individual communications after the exploit could become evidence. The claim seeks aggravated and punitive damages, which require proof of conduct beyond ordinary negligence and could amplify the case's stakes.

The broader implications matter for the entire cross-chain interoperability sector. Bridges remain a critical vulnerability in decentralized finance because they concentrate trust in a small set of verifiers, oracles, or multisig signers. A 1-of-1 configuration removes redundancy and creates a single point of failure; if that point is compromised, unbacked assets can be minted. The lawsuit argues that LayerZero, as the vendor providing that architecture and the entity whose systems were compromised, bears responsibility. If Evercrest prevails, infrastructure providers may face a duty to warn clients when default configurations carry material security risks, and written assurances about code quality could create actionable representations. The fact that LayerZero allegedly warned USDT0 but not KelpDAO could support a differential treatment argument.