← Bryan Pellegrino (LayerZero CEO)reviewed 2026-10-27 · 10 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Bryan Pellegrino (LayerZero CEO) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #1[link rot][awaiting moderator]in the timeline
“https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains”
reviewerLayerZero attributes the KelpDAO attack to TraderTraitor (Lazarus Group), per the cited CoinDesk April 19 articleThe cited CoinDesk article does not support the attribution, so the source no longer supports the claim. The claim itself is supported by LayerZero's incident report. The same article is also cited for the DVN-compromise detail in sections[0], which it does not contain.Proposed correction (not yet applied)https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: The April 2026 rsETH Bridge Exploit
“a LayerZero developer was socially engineered into installing malware”
reviewerDeveloper was socially engineered into installing malware and attacker launched a DDoS on an external RPC providerDate and overall mechanism match. The report says session keys were obtained and does not use the word malware. The DDoS wording elsewhere in the same paragraph is also slightly stronger than the report's DoS. - #3[partially supported][awaiting moderator]in the timeline
“2026-05-09”
reviewerLayerZero's May apology was issued on May 9, 2026The page's own date_evidence says 'Friday (May 9, 2026)', which is internally inconsistent. The apology was likely posted May 8 and reported May 9. The quotes and the disabling of 1-of-1 configurations are confirmed. The date is probable rather than certain. - #4[partially supported][awaiting moderator]in section: Dispute Over the Single-Verifier Configuration and LayerZero's Shifting Account
“On May 9, 2026, LayerZero reversed its posture”
reviewerOn May 9, 2026, LayerZero issued the public apologySame underlying date discrepancy as the timeline entry. May 9 may be the reporting date. - #8[partially supported][awaiting moderator]in section: Evercrest v. LayerZero: Civil Claim Naming Pellegrino Personally
“January 2025 (allegedly stating that a compromised verifier could only fail to verify messages correctly)”
reviewerEvercrest alleges written endorsements on at least three occasions, including January 2025Two of the three dated endorsements were verified. The January 2025 item was not found in the sources I read. I did not fetch Decrypt, so this is not a finding that it is wrong.
confirmed
5 claimsThe cited evidence supports the claim as written.
- #5[confirmed][no action needed]in section: Dispute Over the Single-Verifier Configuration and LayerZero's Shifting Account
“would migrate default settings to require at least five verifiers, with a floor of three on chains where fewer DVNs are available”
reviewerAfter the apology LayerZero would migrate defaults to at least five verifiers with a floor of threeMatches The Block. - #6[confirmed][no action needed]in section: Evercrest v. LayerZero: Civil Claim Naming Pellegrino Personally
“On or around September 24, 2026, Evercrest Technologies Inc., the company that operates KelpDAO, filed a notice of civil claim in the Supreme Court of British Columbia”
reviewerEvercrest filed the notice of civil claim around September 24, 2026 against LayerZero Labs Ltd., LayerZero Labs Canada Inc. and PellegrinoThursday is Sept 24. The 'see contradictions' reference to Sept 25 is only the publication date and is not a real conflict. - #7[confirmed][no action needed]in section: Evercrest v. LayerZero: Civil Claim Naming Pellegrino Personally
“citing more than $650 million in user withdrawals from KelpDAO-related products following the exploit”
reviewerClaim cites more than $650 million in user withdrawals, and LayerZero warned USDT0 about similar risksSupported by The Block. Note that CoinDesk, cited alongside, does not carry these details. - #9[confirmed][no action needed]in section: Evercrest v. LayerZero: Civil Claim Naming Pellegrino Personally
“The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.”
reviewerPellegrino called the claim meritless and said he would defend himself in VancouverVerbatim match. - #10[confirmed][no action needed]in section: The April 2026 rsETH Bridge Exploit
“On April 18, 2026, an attacker drained 116,500 rsETH (then worth approximately $292 million)”
reviewerThe attacker drained 116,500 rsETH, about $292 million, on April 18, 2026Amount and date match.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.