On September 25, 2026, three crypto newsrooms reported that KelpDAO has sued LayerZero and its CEO over a $292 million exploit tied to its rsETH bridge setup. Here is exactly what the headlines confirm, what remains unknown hours after the news broke, and the practical checks a holder can run right now on their own exposure.
What exactly happened between KelpDAO and LayerZero?
On September 25, 2026, KelpDAO filed a lawsuit against LayerZero and its CEO over a $292 million exploit connected to its rsETH bridge setup. The news was reported by The Block, CoinDesk and Cointelegraph within roughly 25 minutes of each other, and this article was written the same morning the story broke.
According to those headlines, KelpDAO claims LayerZero endorsed the setup that was used in the exploit. CoinDesk characterized it as the largest exploit 2026 has seen so far. Cointelegraph confirmed the suit names both the company and the CEO personally, and frames the event around an rsETH bridge exploit.
That is the full extent of what is confirmed. The rest of this piece separates the known from the unknown so you can act on facts, not speculation.
The confirmed facts, in one place
- Who: KelpDAO is the plaintiff; LayerZero and its CEO are the named defendants.
- What: A lawsuit tied to a bridge exploit affecting rsETH.
- How much: $292 million, described as 2026's largest exploit so far.
- The claim: KelpDAO alleges LayerZero endorsed the setup used in the exploit.
- When: Reported the morning of September 25, 2026.
What is rsETH and why does the bridge matter?
rsETH is KelpDAO's liquid restaking token, a receipt that represents restaked ETH. A bridge is the infrastructure that moves a token's value or messaging across different blockchains, and it is one of the most exploited components in all of DeFi.
The headlines tie the $292 million loss to a bridge setup rather than to the underlying ETH itself. Beyond that, the newsrooms have not yet published the mechanical details of how the exploit worked, so we will not invent them here.
If you hold or track liquid restaking tokens alongside spot ETH, it helps to see them side by side. Our guide on tracking stocks and crypto together in one app covers how to keep restaking receipts, wrapped tokens and native coins in a single view.
What is still unknown right now?
Most of the important details are not yet public, and honest uncertainty is more useful to you than confident guesses. As of this morning, the headlines do not confirm the following:
- How the exploit was executed. The technical mechanism has not been detailed by the three newsrooms cited.
- How much, if anything, is recoverable. No headline states whether funds were frozen, clawed back or insured.
- Where losses ultimately fall. It is not confirmed whether individual rsETH holders, the protocol treasury, or a third party absorbed the loss.
- LayerZero's response. No defense or statement from LayerZero or its CEO appears in the cited reporting.
- Any peg impact on rsETH. Whether rsETH is trading at, above or below its intended value has not been confirmed by these sources.
Anyone telling you the full story hours after a filing is filling gaps with assumptions. Treat unverified figures and recovery promises with caution until a primary source confirms them.
How can a holder check their own exposure?
Checking your exposure means confirming, in numbers, exactly how much of your portfolio touches rsETH, KelpDAO, restaking, or bridge-dependent tokens. This is a factual review of your own positions, not a decision about them.
Direct and indirect exposure to map
- Direct rsETH: any balance of the liquid restaking token itself.
- Restaking-adjacent tokens: other liquid restaking or liquid staking derivatives you hold.
- Bridge-dependent assets: anything you moved across chains using the affected infrastructure.
- Protocol tokens: governance or reward tokens linked to the projects involved.
Traders who split assets across multiple wallets and exchanges often underestimate a single token's real weight. If you're using PortfolioTrackr, you can enter positions manually, by voice, by text, from a CSV, or from a broker screenshot, then see rsETH and every related token as one consolidated line with a live percentage of your total. Connecting an exchange is optional; nothing here requires it.
PortfolioTrackr supports both stocks and crypto across 100 exchanges and 67 display currencies, so a holder in one market can value an ETH-denominated position in their home currency without a spreadsheet. Our comparison of portfolio trackers versus spreadsheets explains why a live view matters most on days like this.
How do you set a price alert on rsETH or ETH?
A price alert notifies you when a specific level you choose is reached, so you learn about a move without staring at a screen. In PortfolioTrackr, every position and every watchlist level is checked once a minute, around the clock, and you hear within a minute of your level being hit.
Levels a holder might want to monitor
- A level on rsETH itself, if you hold it directly.
- A level on ETH-USD, since restaking tokens track ETH's underlying value.
- Levels on any bridge-linked or protocol token in your book.
PortfolioTrackr reports status against your own targets, for example still below target, Target 1 reached, or your stop-loss level reached. It does not tell you what to do with a position; the decision stays entirely yours. Watchlist alerts are available on every plan.
| Check | What it answers | Where in PortfolioTrackr |
|---|---|---|
| Exposure | How much of my portfolio touches rsETH or restaking | Consolidated holdings view |
| Alert | Has a level I care about been reached | Price alerts (checked once a minute) |
| Allocation | Is one theme a larger share than I realized | Allocation breakdown by asset and sector |
Why does bridge risk keep hitting DeFi portfolios?
Bridges keep appearing in the largest crypto losses because they concentrate value and complexity in one place. A single bridge often custodies or messages for hundreds of millions of dollars, which makes it a high-value target and a single point of failure.
This lawsuit is notable because it targets not just the exploited protocol but the infrastructure provider KelpDAO says endorsed the setup. Whatever the courts decide, the practical lesson for a holder is the same as after previous incidents: know which of your assets depend on cross-chain infrastructure.
For a sense of how exchange and infrastructure shutdowns force holders to move and re-track assets, our write-up on what to do when a venue is closing walks through keeping records intact during disruption.
What should you watch next?
Watch for confirmation of the details the headlines have not yet supplied. Concrete things to track over the coming hours and days include:
- A statement from LayerZero or its CEO responding to the claim.
- The court filing itself, which should specify the legal theory and any requested remedy.
- Any confirmed information on fund recovery, freezes or reimbursement.
- The trading behavior of rsETH relative to ETH, confirmed by reliable price data.
- Any knock-on effects for other tokens that rely on the same bridge setup.
Set alerts on the levels that matter to you so you learn of moves within a minute, and revisit your allocation once the facts are clearer. Reviewing is always yours to do; nobody should be telling you how to trade off a headline this fresh.
The bottom line
As of the morning of September 25, 2026, KelpDAO has sued LayerZero and its CEO over a $292 million exploit tied to its rsETH bridge setup, in what CoinDesk calls 2026's largest exploit so far. The mechanism, the recovery picture and LayerZero's response are all still unconfirmed.
The useful moves for a holder are factual, not speculative: map your exposure to rsETH and bridge-linked tokens, set alerts on the levels you care about, and check how large the theme really is in your book. A consolidated view in PortfolioTrackr makes each of those checks a two-minute job while the story develops.
Crypto and stocks in one portfolio
Track coins alongside equities, ETFs and funds, in your own base currency, with the same alerts and P&L on both.
Start Free Trial
Frequently asked questions
What is the KelpDAO lawsuit against LayerZero about?
On September 25, 2026, KelpDAO sued LayerZero and its CEO over a $292 million exploit tied to its rsETH bridge setup, alleging LayerZero endorsed the setup used in the exploit. CoinDesk described it as 2026's largest exploit so far. Full technical and recovery details were not yet public when the story broke.
How much was lost in the rsETH bridge exploit?
The three newsrooms reporting the story, The Block, CoinDesk and Cointelegraph, put the figure at $292 million. CoinDesk framed it as the largest crypto exploit of 2026 to date. Whether any of those funds are recoverable, frozen or insured had not been confirmed at the time of reporting.
How do I check if I have exposure to rsETH?
List every wallet and exchange where you hold rsETH, other restaking or staking derivatives, or tokens you bridged across chains, then total their share of your portfolio. PortfolioTrackr consolidates positions from manual entry, voice, text, CSV or broker screenshots into one view with a live percentage weight for each holding.
Can PortfolioTrackr alert me if rsETH or ETH hits a price?
Yes. PortfolioTrackr checks every position and watchlist level once a minute around the clock, and you hear within a minute of your level being reached. It reports status against your own targets, such as Target 1 reached, without telling you what to do. Watchlist alerts are on every plan.
Why are crypto bridges so often exploited?
Bridges concentrate large amounts of value and complex code in one place, which makes them high-value targets and single points of failure. Many of DeFi's biggest losses have involved cross-chain infrastructure. Knowing which of your assets depend on a bridge is the practical way to understand your own risk.