LayerZero Fallout Pushes Crypto Firms Toward Chainlink

Kelp Reopens rsETH Bridging Under Stricter Controls

Aave transferred the first 25,000 rsETH tranche into the LayerZero OFT adapter on Ethereum mainnet at Ethereum block 25087631, with a transaction fee of 0.00004376 ETH. Aave said on X that the “first tranche of rsETH” had moved into the adapter and that rsETH bridging between mainnet and L2s was “back open.”

Kelp said rsETH contracts would unpause for withdrawals within 24 hours of the first tranche reaching the mainnet adapter. Deposits and exchange-rate updates were expected to follow within 48 hours. Kelp also said staking rewards accrued during the pause would be credited to all rsETH holders.

The recovery plan calls for remaining tranches from Aave’s Recovery Guardian and Kelp’s recovery safe to move into the bridge lockbox over roughly two weeks. The full refill target is 117,132 rsETH, valued at about $278 million. The remaining 92,132 rsETH was expected to be replenished to the LayerZero adapter in staged tranches before normal operations fully resumed.

Kelp’s first recovery phase involved burning the exploiter’s rsETH on Arbitrum. The second phase began with Aave’s transfer to refill the bridge lockbox so cross-chain rsETH circulation could resume with collateral backing. Kelp later said it had burned the hacker’s 117,132 rsETH during the same week.

Kelp’s reopened bridge uses a hardened security model audited by BailSec. The LayerZero verification requirement increased from a single attestor to four independent attestors, while block confirmation thresholds rose from 42 to 64. All L2-to-L2 bridging routes were deprecated as part of the restart.

A technical post-mortem attributed the exploit to an RPC poisoning attack by North Korea’s Lazarus Group, specifically the TraderTraitor subunit. The attackers allegedly compromised downstream RPC nodes used by LayerZero verifiers for Unichain L2 observation and fed forged data into the verification process, tricking the single-verifier bridge into releasing 116,500 rsETH on Ethereum mainnet without a legitimate source-side burn.

The exploit-to-restoration window lasted 26 days. Kelp’s recovery relied on coordinated ecosystem funding through DeFi United, an on-chain burn of attacker collateral and legal authorization. Judge Margaret Garnett cleared the transfer of recovered ETH to Aave, though the assets remained in an Aave-controlled wallet pending further court authorization.

Kraken, Lombard and Other Protocols Move to Chainlink CCIP

Kraken said it was deprecating its existing cross-chain provider and migrating to Chainlink CCIP as the exclusive cross-chain infrastructure for Kraken Wrapped Bitcoin, or kBTC, and all future wrapped tokens. Kraken said Chainlink CCIP “offers enterprise-grade infrastructure with strict security and risk management requirements,” citing certifications, secure-by-default design, 16 independent nodes and native rate limits.

LayerZero issued what it called an “overdue apology” and said it had done a “terrible job on comms over the past three weeks.” LayerZero said its internal RPCs had been attacked and that its “source of truth” had been poisoned, while external RPC providers were simultaneously hit by a denial-of-service attack.

LayerZero blamed Kelp’s configuration on its single-DVN setup, meaning a single Decentralized Verifier Network design. LayerZero also said no other application had been affected and that more than $9 billion in bridged assets had moved using the protocol since April 19, 2026.

Lombard became the latest major protocol named in the migration wave, deprecating LayerZero and moving more than $1 billion in bitcoin-backed assets after an internal security review. Lombard issues two bitcoin-backed tokens, LBTC and BTC.b, and said it would first migrate assets across Solana, Etherlink, Berachain, Corn and TAC.

Lombard is also ending LayerZero usage on Morph and Swell. Lombard said Chainlink CCIP gives it independent node operators, built-in rate limits and audited infrastructure. The protocol is also adopting Chainlink’s Cross-Chain Token standard, which allows tokens to move across chains through a burn-and-mint model.

Johann Eid, chief business officer at Chainlink Labs, said: “We are witnessing a continued flight to safety across the industry.” Lido, described as the world’s largest Ethereum liquid staking protocol, also uses Chainlink CCIP and said in a Thursday blog post that “Chainlink’s defense-in-depth model acts as the definitive standard for cross-chain interoperability.”

Numerous protocols had reportedly suspended bridging using LayerZero. CoinDesk put the broader migration figure at roughly $4 billion in assets either already moved or being moved to Chainlink CCIP, reflecting Lombard’s addition to the group. 

LINK remained near a bear-market low around $10, down roughly 80% from its 2021 peak, despite Chainlink’s migration headlines. LayerZero’s ZRO had declined more than 30% since the April hack and was down more than 80% from its 2024 all-time high.

LayerZero did not immediately respond to requests for comment. Competing liquid restaking protocols, including Ether.fi and Renzo, were positioned as direct observers of the fallout because user liquidity could return to Kelp after contracts fully unpause or migrate elsewhere.