Approximately $15 billion in assets has migrated from LayerZero to Chainlink's Cross-Chain Interoperability Protocol as major crypto firms including BitGo, Kraken, Mantle, and the state of Wyoming abandoned the bridge protocol following a $292 million exploit that exposed critical vulnerabilities in its architecture.
The mass migration represents one of the largest shifts in cross-chain infrastructure in the history of decentralized finance, triggered by the April 18, 2026 Kelp DAO exploit in which attackers drained 116,500 rsETH worth approximately $292 million through a LayerZero-powered bridge. The exploit exploited a single-verifier configuration, a vulnerability that called into question the security model underlying LayerZero's cross-chain messaging system.
The Kelp DAO Exploit That Started the Exodus
On April 18, 2026, attackers exploited a vulnerability in Kelp DAO's LayerZero-powered bridge, draining 116,500 rsETH worth approximately $292 million. The exploit targeted a single-verifier configuration that allowed the attacker to bypass the bridge's security checks by compromising a single point of failure. The attack highlighted the risks of cross-chain bridges that rely on a small number of validators or verifiers.
The Kelp DAO exploit was not an isolated incident. In April 2026, two additional Lazarus-linked attacks against DriftProtocol and KelpDAO reportedly drained a combined $577 million using social engineering and compromised devices. The pattern of exploits targeting cross-chain infrastructure raised broader concerns about the security of bridge protocols, prompting major institutions to reevaluate their cross-chain infrastructure choices. For more on DeFi security incidents, see our coverage of the Maya Protocol exploit.
Why Major Players Are Choosing Chainlink CCIP
Chainlink's Cross-Chain Interoperability Protocol has emerged as the primary beneficiary of the LayerZero exodus. CCIP uses a different security model than LayerZero, relying on a decentralized network of node operators and multiple layers of verification to secure cross-chain transactions. This architecture eliminates the single points of failure that were exploited in the Kelp DAO attack.
BitGo, one of the largest cryptocurrency custody providers, replaced LayerZero with Chainlink CCIP for its Wrapped Bitcoin (WBTC) product, which represents billions of dollars in tokenized Bitcoin on Ethereum. The decision to migrate WBTC's cross-chain infrastructure was particularly significant given the product's importance to the DeFi ecosystem. Kraken, Mantle, and the state of Wyoming also migrated their cross-chain operations to Chainlink CCIP. For more on institutional crypto infrastructure, see our coverage of BitGo Korea's expansion.
The $15 Billion Migration
The total value of assets migrating from LayerZero to Chainlink CCIP has reached approximately $15 billion, according to analysis of on-chain data. This figure includes WBTC and other tokenized assets that were previously secured by LayerZero bridges. The migration represents a significant reallocation of value within the DeFi ecosystem, with Chainlink's CCIP protocol absorbing assets that were previously flowing through LayerZero's infrastructure.
The migration has driven a surge in Chainlink network activity to an eight-month high, as the protocol's CCIP product processes an increasing volume of cross-chain transactions. Chainlink's LINK token has benefited from the increased usage, as the protocol's tokenomics reward node operators for securing cross-chain transactions. The migration demonstrates how security concerns can drive rapid shifts in DeFi infrastructure usage, as institutions prioritize the safety of their assets over familiarity with existing systems. For more on cross-chain developments, see our coverage of cross-chain asset expansion.
What This Means for Cross-Chain Security
The $15 billion migration from LayerZero to Chainlink CCIP signals a shift in how the crypto industry thinks about cross-chain security. For years, bridge protocols competed primarily on speed, cost, and ease of integration. The Kelp DAO exploit and subsequent migration suggest that security is becoming the primary consideration for institutions choosing cross-chain infrastructure.
The migration also demonstrates the importance of decentralized verification in cross-chain bridges. LayerZero's multi-signature and single-verifier configurations created attack surfaces that could be exploited by sophisticated attackers. Chainlink CCIP's decentralized oracle network, which has been securing cross-chain transactions for years without a major exploit, offers a more robust security model that institutions appear willing to pay a premium for. For more on crypto security trends, read our coverage of Bybit's security overhaul.
For the latest DeFi news, visit Bitnxt.
