In a dramatic escalation within the decentralized finance (DeFi) ecosystem, KelpDAO, a prominent cross‑chain lending protocol, has filed a lawsuit against LayerZero, the blockchain interoperability layer, and its co‑founder Brian Pellegrino. The legal complaint alleges that LayerZero deliberately failed to disclose significant security flaws in its messaging protocol, a lapse that KelpDAO claims directly enabled the massive $292 million hack that shook the industry earlier this year. The lawsuit, filed in a federal court in New York, outlines a series of accusations that paint a picture of negligence, misrepresentation, and a breach of fiduciary duty.
According to the complaint, LayerZero’s team was aware of a set of vulnerabilities in its core cross‑chain messaging system—specifically, weaknesses that could be exploited to reroute or alter transaction data as it moved between disparate blockchain networks. Rather than promptly informing its partners and the broader community, the company allegedly kept these issues under wraps, allowing the vulnerabilities to persist while the protocol continued to be widely adopted for high‑value asset transfers. KelpDAO, which relies on LayerZero’s technology to enable seamless borrowing and lending across multiple chains, asserts that it was directly impacted by the exploit.
In early March 2026, attackers leveraged the undisclosed flaw to manipulate message proofs, effectively forging false confirmations that allowed them to withdraw assets from KelpDAO’s liquidity pools. The breach resulted in the loss of approximately $292 million worth of tokens, a figure that includes both native assets and stablecoins that were collateralized within the platform.
The complaint details how the attackers, after gaining access to the compromised messaging pathway, executed a series of coordinated transactions that bypassed KelpDAO’s internal risk controls. By spoofing cross‑chain proofs, they were able to present the protocol with seemingly legitimate transfer requests, prompting KelpDAO’s smart contracts to release funds that were never actually backed by the claimed collateral. The rapid succession of these fraudulent withdrawals overwhelmed KelpDAO’s emergency shutdown mechanisms, leaving the platform unable to halt the outflow before the majority of the capital was siphoned off.
Beyond the immediate financial loss, KelpDAO’s legal team argues that the exploit has caused extensive reputational damage, eroding user trust not only in KelpDAO but also in the broader class of cross‑chain solutions that depend on LayerZero’s infrastructure. The lawsuit seeks compensatory damages to cover the stolen assets, as well as punitive damages intended to deter similar conduct in the future.
Additionally, KelpDAO is demanding that LayerZero provide a full, public disclosure of all known vulnerabilities, a comprehensive audit of its codebase, and the implementation of third‑party security oversight for any future updates. LayerZero’s response to the allegations has been notably terse.
In a brief statement released shortly after the filing, the company expressed disappointment at the legal action and affirmed its commitment to “continuous improvement of security protocols.” However, the statement stopped short of addressing the specific claims about prior knowledge of the vulnerability. Industry observers note that this silence may be strategic, as any admission could be used against LayerZero in the ongoing litigation.
Legal experts suggest that the case could set a precedent for how DeFi projects handle security disclosures. Traditionally, many blockchain projects have operated under a veil of opacity, often relying on informal bug‑bounty programs or private audits without publicly sharing findings. The KelpDAO lawsuit challenges that norm, arguing that when a platform’s technology is integral to the operation of third‑party services, there exists a duty to disclose material risks in a timely manner. If the court rules in favor of KelpDAO, the ramifications could be far‑reaching.
Not only might LayerZero be required to compensate KelpDAO and its users, but the decision could compel other interoperability providers to adopt more transparent security practices. This could lead to a wave of mandatory disclosures, heightened regulatory scrutiny, and potentially a new wave of insurance products tailored to cover cross‑chain vulnerabilities. Meanwhile, the broader DeFi community is watching closely.
Several other protocols that integrate LayerZero’s messaging layer have announced internal reviews of their own security postures. Some have temporarily paused cross‑chain operations until they can verify that the underlying messaging protocol is free of exploitable flaws. This cautious approach underscores the heightened sensitivity to systemic risk that the $292 million breach has amplified.
In the aftermath of the exploit, KelpDAO has taken steps to mitigate further damage. The protocol has implemented an emergency withdrawal freeze, migrated critical assets to a more isolated, single‑chain environment, and engaged a leading cybersecurity firm to conduct a forensic analysis of the attack vector. The findings from this analysis are expected to be released in a detailed report later this month, which KelpDAO hopes will provide clarity on how the breach occurred and what safeguards will be instituted moving forward. The lawsuit also highlights the growing importance of legal frameworks in the decentralized space.
As DeFi projects mature, the intersection of code, finance, and law becomes increasingly complex. Stakeholders—from developers and investors to regulators—must navigate a landscape where traditional legal concepts such as negligence, fiduciary duty, and consumer protection are being reinterpreted for code‑driven platforms. For now, the outcome of KelpDAO’s legal battle with LayerZero remains uncertain. The case will likely involve extensive technical testimony, expert witness depositions, and a deep dive into the inner workings of cross‑chain messaging protocols.
Regardless of the verdict, the proceedings are poised to influence how future DeFi collaborations are structured, how security risks are communicated, and how accountability is enforced in an ecosystem that has long prized anonymity and decentralization over conventional oversight. In summary, KelpDAO’s lawsuit against LayerZero and Brian Pellegrino alleges a deliberate concealment of critical security weaknesses that enabled a $292 million hack, causing both financial loss and reputational harm. The legal action seeks restitution and broader industry reforms, potentially reshaping the standards for vulnerability disclosure and risk management across the DeFi sector.