LayerZero loses $15 billion in DeFi exodus to Chainlink CCIP

The Kelp DAO exploit drained $292 million and triggered the largest infrastructure migration in DeFi history.

Nearly $15 billion in total value has migrated from LayerZero to Chainlink's Cross-Chain Interoperability Protocol after the April 18 Kelp DAO exploit drained $292 million in rsETH through a forged cross-chain message.

"Governments and other serious institutions require secure, reliable, and standard-setting infrastructure to move digital assets across chains at scale," Sergey Nazarov, co-founder of Chainlink, said.

BitGo moved $7.4 billion in WBTC, Mantle shifted its $2.5 billion Super Portal, and Lombard transferred $1 billion in bitcoin-backed assets. Solv and Virtuals each moved $700 million, Re $475 million, Kraken $330 million in kBTC, and Yuzu Money $54.5 million, according to public migration announcements.

Wyoming's Stable Token Commission finalized the migration of its FRNT stable token on Aug. 18, the first U.S. public entity to abandon LayerZero on security grounds, citing concerns about the protocol's disclosure practices and operational security.

The exploit that broke trust

The Kelp DAO attack was not a smart contract failure. Attackers linked to North Korea's Lazarus Group compromised two internal LayerZero RPC nodes and launched a DDoS attack on external nodes, forging a cross-chain message that a single 1-of-1 DVN verifier approved. The stolen assets were deposited on Aave as collateral to borrow $190 million in WETH, forcing Aave to freeze rsETH markets on V3 and V4.

The architecture gap drove the exodus. LayerZero lets each application choose its own verifier threshold, a design that allowed Kelp DAO to run a single verifier. Chainlink CCIP requires a minimum of 16 independent node operators per lane, a separate Risk Management Network, and native rate limits, with SOC 2 Type 2 and ISO 27001 certification.

The revenue math

LayerZero accounted for an estimated 57 percent of cross-chain volume entering 2026, with over $100 billion in cumulative value transferred. The protocol takes no messaging fee today, but each migration shrinks the base that would generate fees if token holders activate the fee switch. ZRO's market capitalization has fallen to roughly $302 million, down from an all-time high near $7.47, with the token dropping 38.87 percent in the past month.

Nethermind, one of LayerZero's largest DVN operators, ended its verifier role on Aug. 19 and joined Chainlink as a node operator after an "extensive infrastructure review." The departure threatens a reinforcing loop: fewer high-quality verifiers make the network less attractive to applications, reducing fee revenue for remaining operators.

This article is for informational purposes only and does not constitute investment advice.