KelpDAO has filed a lawsuit against LayerZero and CEO Bryan Pellegrino in British Columbia over the $294 million rsETH exploit that occurred on April 18. According to KelpDAO's public account, the complaint alleges that LayerZero failed to disclose technology weaknesses and inadequately secure its infrastructure, allowing attackers to compromise the verifier network. The lawsuit centers on the configuration of Kelp's rsETH bridge, with KelpDAO claiming that LayerZero had reviewed and approved their deployment before the exploit, contradicting LayerZero's later argument that Kelp created a dangerous single-verifier setup. CEO Bryan Pellegrino has called the lawsuit meritless and announced plans to defend himself and LayerZero in Vancouver court proceedings. The restaking protocol argues that LayerZero hid flaws in its own technology and failed to stop attackers from infiltrating its security systems, with KelpDAO stating that "Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures."
On April 18, attackers drained approximately 116,600 rsETH through the LayerZero bridge, making it the largest DeFi exploit of 2026. According to LayerZero, the attackers took over enough remote procedure call (RPC) nodes to feed false data to the bridge's verifier, which relays blockchain data to applications. As a result, the verifier approved an rsETH burn that never happened, and the Ethereum contract then released funds against it. The damage spread quickly, with Aave's total value locked (TVL) falling $8.45 billion within two days, and DeFi TVL dropping broadly across major chains. LayerZero later tied the attack to the Lazarus subgroup TraderTraitor, while the protocol pointed at Kelp's setup, noting the bridge relied on a single verifier operated by LayerZero Labs in a 1-of-1 configuration. The aftershocks of the exploit spread across stablecoin markets, including forcing Aave to borrow $300 million to meet increasing user demand for asset withdrawals, and ultimately erased $20 billion in total value locked (TVL).
Following the exploit, KelpDAO has made significant progress in recovering and securing its operations. According to a May report, the protocol completed replenishing the stolen funds by replenishing its rsETH OFT adapter with 116,000 rsETH, marking a complete restoration of the compromised assets. The protocol has since moved its cross-chain communication layer to Chainlink CCIP to enhance security standards. Additionally, the Arbitrum Security Council froze 30,766 ETH worth of assets tied to the exploit, preventing them from dispersing on-chain. At the time of writing, KelpDAO held roughly 426,819.05 ETH in actual backing, with ETH fully backing its rsETH at a 1:1 ratio. The protocol has resumed normal operations and confirmed that ETH fully backs its rsETH at a 1:1 ratio.
LayerZero experienced a significant 21.73% daily price jump as trading activity expanded substantially, placing the recovery below the crucial $1.50 resistance area. According to reports from AMBCrypto, this daily rise extended ZRO's seven-day gain to 47.41%, reinforcing a recovery that had accelerated throughout the recent past week. The stronger activity was accompanied by a 94.88% increase in spot volume to approximately $163 million, with almost twice as much capital changing hands compared to the previous 24-hour period.
The expanding trading activity was accompanied by large transactions as ZRO's Spot Average Order Size registered big whale orders, implying that bigger market participants appeared increasingly active during the token's recovery. As reported by AMBCrypto, buying pressure also developed within executed trades, with the Spot Taker CVD indicator remaining taker-buy dominant, suggesting aggressive buyers outweighed sellers during the observed period. This whale participation, combined with taker behavior, introduced clearer directional signals behind the spot demand supporting ZRO's price increase.
Despite the recovery efforts, KelpDAO's operational metrics show mixed results. The protocol's Total Value Locked (TVL) has added $266.15 million between August 19 and the present, reaching a high of $1.139 billion at press time. However, these figures remain behind its May 15 level of $1.547 billion, indicating the protocol has not yet fully recovered to pre-exploit levels. Kelp's earnings have plummeted to their lowest quarterly levels at $276,300 according to DeFiLlama, coinciding with gross revenue falling to roughly $6.42 million during the same period. The protocol's on-chain activity continues to show signs of recovery, with TVL measuring the protocol's health by investor capital deposits, though it remains below previous performance levels.
