Kelp Drops Layerzero For Chainlink

@KelpDAO announced Tuesday it is migrating rsETH bridging infrastructure from LayerZero's Omnichain Fungible Token (OFT) standard to @chainlink's Cross-Chain Interoperability Protocol (CCIP), following a devastating April 18 attack that wiped roughly $292 million from its bridge.

What Happened on April 18

On April 18, 2026, attackers linked to North Korea's Lazarus Group stole approximately $292 million in rsETH from KelpDAO's LayerZero bridge. Critically, this was not a smart contract hack but a sophisticated attack on off-chain infrastructure. LayerZero said attackers accessed the list of RPC nodes used by the LayerZero Labs DVN, compromised two of them and swapped out the binaries running on them. They then launched a DDoS attack against uncompromised RPC nodes, forcing a failover to the poisoned ones. The DVN then confirmed transactions that had not occurred.

On LayerZero, every cross-chain message must be verified by one or more Decentralized Verifier Networks (DVNs) before the destination chain acts on it. rsETH was configured with a single verifier: the LayerZero Labs DVN. That single point of failure is at the center of a heated dispute between the two protocols. KelpDAO claims LayerZero personnel approved the 1-of-1 verifier setup, a decision LayerZero has since cited as the reason the attacker was able to drain the bridge. The claim runs counter to LayerZero's April 19 postmortem, which said Kelp's rsETH application relied on LayerZero Labs as its sole verifier and that the setup "directly contradicts" LayerZero's recommended multi-DVN model.

Kelp's core restaking contracts were not touched and the exploit was isolated to the bridge layer. Its emergency pause, 46 minutes after the drain, blocked two follow-up attempts that would have released an additional roughly $200 million in rsETH.

Switching to Chainlink CCIP

Kelp said it is moving rsETH off LayerZero to Chainlink's Cross-Chain Interoperability Protocol. The shift moves rsETH from LayerZero's OFT standard to Chainlink's Cross-Chain Token standard. @chainlink now handles validation across the 20-plus networks on which rsETH is deployed. Kelp said the move is intended to ensure ethereum:0xa1290d69c65a6fe4df752f95823fae25cb99e5a7 is fully secure with infrastructure that "doesn't leave these questions open."

The incident was not a smart contract vulnerability. There was no reentrancy bug, no missing access check, no price oracle manipulation. The KelpDAO incident represents something arguably more dangerous: an attack on the off-chain verification layer on which many cross-chain protocols depend. As a consequence, LayerZero said it will no longer sign messages for any application running a single-verifier setup, forcing a protocol-wide migration.

CoinGecko, citing Dune Analytics data, said 47% of roughly 2,665 active LayerZero OApp contracts ran a 1-of-1 DVN configuration over a 90-day period ending around April 22, with more than $4.5 billion in associated market value exposed to the same class of risk. That figure underscores how the fallout from the KelpDAO breach extends well beyond one protocol.

Sources
CoinDesk: Kelp says LayerZero approved setup it blamed for $292 million bridge hack
Chainalysis: Inside the KelpDAO Bridge Exploit
CoinDesk: Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains