KelpDAO takes LayerZero to court over $292 million rsETH exploit
KelpDAO has filed a lawsuit against LayerZero, alleging that the cross-chain infrastructure firm endorsed a technical configuration that was subsequently used in a $292 million exploit targeting rsETH, according to a report published by The Block on 25 September 2026.
The suit, reported at 5:13 AM EDT, transforms what began as one of the year’s largest security incidents into a formal legal dispute over who bears responsibility when one protocol’s approved setup is weaponised in another protocol’s failure. KelpDAO’s core allegation is that LayerZero approved or endorsed a configuration that attackers then used to drain funds through the rsETH-related system.
The full mechanics of the exploit, the precise legal claims advanced in the filing, and any response from LayerZero were not detailed in the initial report. What is clear is the scale: the $292 million figure places the rsETH incident among the largest crypto security events referenced on The Block’s front page that day, and among the most significant DeFi losses recorded in recent memory.
For readers tracking the wider fallout from restaking and cross-chain failures, our DeFi coverage follows the story as it develops.
What KelpDAO alleges and why the number matters
At the centre of the dispute is rsETH, the liquid restaking token associated with KelpDAO’s ecosystem. Liquid restaking tokens of this kind have grown into a substantial corner of the DeFi market, representing claims on restaked collateral that can be deployed across lending markets, liquidity pools and cross-chain bridges. That very portability, which underpins the product’s appeal, also widens the attack surface: the security of an rsETH position depends not only on KelpDAO’s own contracts but on every bridge, messaging layer and integration that touches the token.
This is the crux of KelpDAO’s argument. The protocol is not simply alleging that a hack occurred. It is alleging that LayerZero, as an infrastructure provider whose messaging and cross-chain systems sit beneath numerous integrations, endorsed a specific configuration that was later exploited. In effect, KelpDAO is asking a court to treat a technical approval as a liability-bearing act.
The $292 million figure gives the claim its weight. Exploits of that magnitude are rare even in a sector that has absorbed billions in losses over the past decade. A loss of this size attached to a liquid restaking token also carries systemic overtones, because rsETH and similar assets are held as collateral across DeFi. When a flagship restaking token suffers a breach, the damage radiates outward through liquidations, depegs and liquidity withdrawals in protocols far removed from the original point of failure.
Whether that contagion materialised in this case is not established by the source reporting. What is established is that KelpDAO has chosen litigation rather than quiet negotiation, a decision that suggests the parties were unable to reach an allocation of losses privately.
The accountability question at the heart of the case
The lawsuit’s significance extends well beyond the two firms involved. It raises a question that DeFi has largely avoided answering: who is accountable when one protocol’s design or endorsement is used in another protocol’s failure?
In traditional finance, liability chains are well trodden. Auditors, underwriters, exchanges and clearing houses all occupy defined legal positions with defined duties. In DeFi and cross-chain infrastructure, the equivalent roles exist in practice but rarely in law. Security assumptions depend on integrations, messaging layers and third-party approvals rather than on a single smart contract alone. A protocol can be technically flawless in its own code and still collapse because a component it relied upon, or a configuration someone else blessed, contained the fatal flaw.
LayerZero sits squarely in that grey zone. Cross-chain messaging providers occupy an infrastructural position akin to plumbing: largely invisible when functioning, instantly implicated when something floods. If KelpDAO’s allegations hold up in court, the implications would reach into how protocols document risk, grant approvals and assign liability after major exploits.
Three consequences stand out.
First, endorsements could become contractual. If a court accepts that LayerZero’s endorsement of a configuration created exposure to liability, infrastructure providers would face pressure to formalise their approvals, disclaim their scope, or withdraw them altogether. Informal technical sign-offs, which are common in fast-moving DeFi integrations, would carry legal risk.
Second, documentation would tighten. Protocols on both sides of an integration would have stronger incentives to record precisely what was approved, by whom, under what assumptions, and with what caveats. The industry’s habit of shipping first and documenting later would become harder to defend.
Third, insurance and risk pricing would shift. Underwriters of smart contract cover already price integration risk, but they do so against a backdrop of legal ambiguity. A ruling that clarifies liability across protocol boundaries would give actuaries something concrete to model, potentially lowering premiums for well-documented integrations and raising them for informal ones.
It bears repeating what the source material does and does not establish. The Block’s report confirms the existence of the lawsuit, the parties, the $292 million figure tied to rsETH, and the central allegation that LayerZero endorsed the exploited setup. It does not provide LayerZero’s response, the court’s jurisdiction, or the specific legal theories pleaded. Any assessment of the suit’s merits must therefore wait for the filings and, in due course, LayerZero’s defence. For ongoing reporting on the parties and the market reaction, our Bitcoin coverage and broader news sections track developments as they break.
Market and regulatory implications
For the market, the lawsuit lands at an awkward moment for cross-chain infrastructure. Bridge and messaging-layer exploits have historically accounted for a disproportionate share of total crypto losses, and institutional participants have long flagged interoperability as among the hardest risks to underwrite. A $292 million incident tied to a major restaking token, followed by litigation against a major messaging provider, sharpens that concern considerably.
Restaking specifically faces a reputational test. The sector has attracted significant capital on the strength of yield-bearing, composable collateral. Each high-profile failure invites the same question: can a token that represents restaked positions, and travels across chains, ever be secured to the standard that its use as collateral implies? KelpDAO’s decision to sue its infrastructure partner rather than absorb the loss quietly suggests the protocol believes the answer involves shared responsibility, and it is willing to test that belief in court.
Regulators will be watching with interest, even if they are not parties to the case. Litigation of this kind performs a function that rulemaking has not yet performed in most jurisdictions: it assigns liability after the fact, case by case, and in doing so writes the precedents that future builders will design around. Financial watchdogs in the United States, the European Union and elsewhere have signalled concern with cross-chain risk; a court judgment quantifying duty of care between integrated protocols would give them a reference point, and could accelerate moves toward formal requirements for integration audits and disclosure.
There is also a competitive dimension. If infrastructure providers respond to the suit by tightening which integrations they will support, smaller protocols may find it harder to obtain the endorsements that lenders, exchanges and institutional allocators increasingly expect. Conversely, providers that develop rigorous, well-documented approval processes could find that certification becomes a selling point in its own right.
Closing analysis
The KelpDAO v LayerZero suit is best understood not as a dispute about a single $292 million hack but as a test of where accountability lives in stacked DeFi systems. The sector’s architecture assumes trust can be distributed across contracts, bridges and approvals. KelpDAO’s claim asserts that distributed trust must still land on identifiable shoulders when it fails.
The outcome is far from settled, and the absence of LayerZero’s public response leaves the evidentiary picture incomplete. But the questions the case forces are already live: whether an endorsement carries liability, whether documentation can substitute for assurance, and whether the informal norms of DeFi integration can survive contact with formal legal scrutiny. However the court rules, the industry’s approach to integration risk is unlikely to emerge unchanged. Protocols, auditors and infrastructure providers would be prudent to assume that from here on, every approval is a document that may one day be read aloud in a courtroom.
