There is a bridge, in this story, and a single guard on it. The bridge moved cryptocurrency worth hundreds of millions of dollars between blockchains. The guard checked that tokens locked on one chain were real before their twins were minted on another. One guard, not two. When the guard was made to lie, nobody was there to say otherwise, and $292 million went out the door.
The question now before the Supreme Court of British Columbia is who put one guard on that bridge. The dead man’s watch, the survivors’ dispute.
On Wednesday, Evercrest Technologies — the company behind KelpDAO, the restaking protocol that was drained in April — filed a notice of civil claim against LayerZero Labs Ltd., LayerZero Labs Canada Inc., and co-founder Bryan Pellegrino, who is sued personally over posts he made on Telegram and X. This is according to Decrypt’s reporting on the filing. The claim pleads negligent misrepresentation, negligence, and defamation, and seeks aggravated and punitive damages. None of the allegations has been tested in court. No response to the claim has been filed.
The setup at issue has a notation like a lock no burglar would respect: 1-of-1. LayerZero’s own verifier network was the only party confirming that tokens had been locked before equivalent tokens were minted. And on the claim’s account, that arrangement was not KelpDAO’s improvisation but LayerZero’s instruction. In February 2024, according to the filing, LayerZero looked at Evercrest’s draft code and called it “good” — the default configuration presented “[n]o problem.” In March 2024, it explicitly directed Evercrest to run 1-of-1 with LayerZero’s own verifier. In January 2025, it offered a reassurance on the downside: even a compromised verifier, Evercrest was told, could at worst fail to verify a message correctly.
Worst, as it turned out, was quite bad.
The claim adds a detail that reads, in the cold formatting of a court document, like the hinge of the whole matter. In late 2024 or early 2025, Evercrest says, LayerZero warned a different developer — one called USDT0 — about the risks in its default verifier configuration, and that developer began running its own verifier. Evercrest says it received no comparable warning. It is hard to read the filing without noticing who got told and who did not.
What followed, on the claim’s account, began inside LayerZero itself. On March 6, an attacker installed malware on a LayerZero developer’s computer — six weeks before any money moved. LayerZero’s nodes were tampered with until they fed false readings to the verifier. On April 18, the attacker disabled the third-party nodes the verifier also consulted, and the guard reported that 116,500 rsETH had been locked on Unichain. Nothing had been locked. With one verifier required and one verifier lying, the tokens were minted unbacked. Evercrest says it paused the bridges within about an hour and blocked a second attempt. By then, $292 million was gone.
The defamation claims turn on what each side said afterward, and here the record is a small chronology of positions. LayerZero’s incident statement said the single-verifier arrangement contradicted a multi-verifier model it had “consistently recommended to all integration partners.” Pellegrino wrote that “[n]obody should be relying on sole DVN.” And then, days later — according to the filing — LayerZero admitted it had “made a mistake by allowing [its] DVN to act as a 1-of-1 DVN for high-value transactions.”
made a mistake by allowing [its] DVN to act as a 1-of-1 DVN for high-value transactions
First the warning everyone had supposedly always heard. Then the admission of the mistake that enabled the setup. Evercrest’s lawsuit exists, in essence, to hold those two sentences side by side in front of a judge.
The damages claimed measure the aftermath. A 2,000 ETH contribution Evercrest made to restore rsETH’s backing. More than $650 million withdrawn from the protocol since the exploit. A fall in the KERNEL token steep enough to draw warnings from regulators and exchanges.
Pellegrino’s public answer came, fittingly, where the alleged defamation began: online. The claim, he tweeted, “continues to be meritless,” and he would come to Vancouver to defend himself.
So the parties will meet in British Columbia, and a court will be asked to decide what was said in February of 2024, and in which direction the instruction ran. One guard on the bridge. Someone chose that number. Nobody should be relying on sole DVN, the chief executive wrote, after the money was gone.