Following the KelpDAO Hack: $40 Billion in Assets Flee LayerZero, Chainlink Emerges as the Primary 'Beneficiary'
Following a major security breach in April where KelpDAO's bridge using LayerZero was attacked for approximately $292 million, a significant shift is underway in the cross-chain infrastructure landscape. An estimated $40 billion in assets is in the process of migrating or has already migrated from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP).
The attack exploited a single-point-of-failure vulnerability due to KelpDAO's 1-of-1 validator configuration within the LayerZero network. Attackers corrupted RPC nodes and used DDoS attacks to force the system to rely on compromised nodes, allowing fraudulent messages. While LayerZero acknowledged a serious error in allowing its validator network to service high-value transactions with such a configuration, the incident highlighted critical security risks.
This triggered a rapid migration wave. Starting with KelpDAO on May 6th, several major protocols—including Solv Protocol, Re, Tydro, Kraken, and Lombard—announced switching their cross-chain infrastructure exclusively to Chainlink CCIP. The combined value of these migrations is estimated to be around $40 billion. This movement followed earlier major adoptions by Coinbase (in late 2025) and Circle (in early 2024).
Market sentiment reflected this shift, with LINK's price showing relative stability while ZRO (LayerZero's token) declined significantly. Data indicates a net outflow of approximately $20.1 billion from the LayerZero network over 30 days.
The migration is largely driven by perceived security differences. Chainlink CCIP employs a decentralized oracle network as its default consensus layer, featuring multiple independent node operators, a separate Risk Management Network, and built-in safeguards like rate limits. In contrast, LayerZero's highly modular architecture offers flexibility but places more responsibility on application developers to configure security settings, a risk underscored by the KelpDAO incident.
LayerZero has since apologized for its communication handling post-attack and stated the protocol itself was not compromised, but rather its Labs DVN's internal RPC was poisoned. An official post-mortem report with external security partners is forthcoming.
marsbit05/19 08:10
