More than $7.2 billion in cross-chain assets have migrated from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP) since May 2026. The exodus began after the $292 million Kelp DAO bridge exploit on April 18, which exposed a single-verifier configuration flaw in LayerZero's Dece...
"We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions." — Bryan Pellegrino, Co-Founder, LayerZero Labs
More than $7.2 billion in cross-chain assets have migrated from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP) since May 2026. The exodus began after the $292 million Kelp DAO bridge exploit on April 18, which exposed a single-verifier configuration flaw in LayerZero's Decentralized Verifier Network (DVN). Mantle's $2.5 billion Super Portal, the latest to switch, completed its migration window between July 9 and 15.
The migration wave is restructuring an $8 billion-plus cross-chain messaging market. CCIP's Q1 2026 transfer volume grew 78% quarter-over-quarter and 319% year-over-year, reaching $18 billion for the quarter. Fee revenue rose 213% QoQ. Meanwhile, bridge exploits have accounted for $340.7 million in losses across 14 incidents in 2026 through June 1 — nearly half of total DeFi exploit losses — forcing protocols to re-evaluate infrastructure choices along security lines rather than cost or speed alone.
On April 18, 2026, attackers linked to North Korea's Lazarus Group drained approximately $292 million (116,500 rsETH) from KelpDAO's LayerZero-powered bridge. The attack was not a smart contract exploit. It was a compromise of off-chain infrastructure.
According to Chainalysis, the breach began on March 6, when an attacker socially engineered a LayerZero Labs developer to harvest session keys, then pivoted into LayerZero's RPC cloud environment. The attacker patched running RPC memory with a program that returned correct responses to LayerZero monitoring tools while feeding tampered data to the LayerZero Labs DVN. This tricked the Ethereum contract into releasing funds based on a phantom token burn on the source chain.
The critical failure point: KelpDAO's rsETH bridge was configured with a 1-of-1 DVN — meaning LayerZero Labs was the sole verifier. According to Kelp, this was the default configuration shipped for new deployments at the time of its Layer 2 expansion. LayerZero initially disputed responsibility but reversed course on May 9, with the company stating it "made a mistake" and announcing that its DVN would no longer service 1/1 configurations. All defaults are being migrated to 5/5 minimum, or 3/3 on chains where only three DVNs are available.
The exploit triggered the largest competitive realignment the cross-chain bridge sector has seen since the Wormhole hack of 2022.
The $7.24 billion in announced migrations from LayerZero to CCIP breaks down as follows, according to CoinDesk and The Block reporting:
| Protocol | Approximate Value Migrated | Migration Date | |----------|---------------------------|----------------| | Kelp DAO | $1B+ | May 2026 | | Lombard | $1B+ | May 2026 | | Solv Protocol | Undisclosed | May 2026 | | Virtuals | Undisclosed | May–June 2026 | | Re | Undisclosed | June 2026 | | Kraken (kBTC, future wraps) | Undisclosed | May 2026 | | Mantle (MNT Super Portal) | $2.5B | July 9–15, 2026 |
Mantle's migration is notable for its scale and partnership structure. The Super Portal, co-developed with Bybit, deprecated the LayerZero OFT standard and adopted Chainlink's Cross-Chain Token (CCT) standard. According to Mantle's press release, every CCIP bridge lane is secured by 16 independent, security-reviewed node operators, with native rate limits acting as circuit breakers during extreme scenarios.
Kraken's decision in May to replace LayerZero with CCIP for kBTC and future wrapped assets carries particular weight. As one of the largest regulated exchanges globally, its infrastructure choices signal institutional preference.
Chainlink published its Q1 2026 quarterly review with the following CCIP metrics:
Institutional integrations in Q1 included Visa, ANZ, ChinaAMC, and Fidelity International completing a cross-border settlement solution under the Hong Kong Monetary Authority's e-HKD program. Coinbase selected CCIP as exclusive bridge infrastructure for its chain. DTCC and Canton Network adopted Chainlink standards for institutional tokenization workflows.
The Spiko Amundi Overnight Swap Fund (SAFO), powered by Chainlink data infrastructure, reached $400 million in AUM within three weeks of launch — underscoring the protocol's role in tokenized fund infrastructure.
Despite the migration wave, LayerZero retains a dominant position by certain metrics. According to BlockEden research, LayerZero processes approximately 75% of all cross-chain bridge volume, averaging $293 million in daily transfers. Lifetime cross-chain volume exceeds $200 billion. The protocol controls roughly 85% of the cross-chain messaging market by message count.
These figures reflect LayerZero's deep integration across DeFi applications built in 2023–2025, before the security narrative shifted. Volume is sticky — existing integrations do not switch overnight, and many smaller protocols have not announced migration plans.
However, the trust deficit is measurable. According to CoinDesk, crypto firms managing approximately $4 billion in assets initiated moves to CCIP by mid-May alone, before the Mantle migration added another $2.5 billion. LayerZero's ZRO token fell 16% amid the security concerns, according to CoinMarketCap.
LayerZero is responding on two fronts. First, it tightened security defaults across all DVN configurations. Second, it announced Zero — a new chain targeting tokenization of traditional financial assets — in February 2026, positioning for institutional adoption despite the reputational damage. According to AMBCrypto, LayerZero is actively pitching its cross-chain protocol to Wall Street institutions.
The cross-chain bridge market extends beyond the CCIP-LayerZero dynamic. The top-tier competitive set includes:
Wormhole: Processes over $1 billion daily. Supports 30+ networks. Secured by 19 guardian validators. Originated in the Solana ecosystem and has expanded to function as both a token bridge and general messaging layer.
Axelar: Has moved $13 billion across its network cumulatively. Circle acquired Interop Labs (Axelar's core development entity) in early 2026; the Axelar Network, Foundation, and AXL token continue operating independently under community governance. Axelar remains the standard path for Cosmos-to-EVM bridging.
Across Protocol: Positioned as a speed-optimized bridge with intent-based architecture. Gained market share among DeFi-native users seeking faster settlement.
Circle CCTP V2: Circle's own cross-chain transfer protocol for USDC, operating natively without wrapped tokens. The Circle-Axelar acquisition added cross-chain messaging capabilities to Circle's existing mint-and-burn USDC infrastructure.
The top five protocols by TVL collectively control approximately 58% of total cross-chain bridge TVL, according to industry data. Total bridge TVL exceeded $20 billion in early 2026, with daily cross-chain transaction volumes surpassing $4 billion — up from $500 million in 2022.
Cross-chain bridges remain the highest-value attack surface in DeFi. Through June 1, 2026:
Beyond the Kelp DAO exploit, notable 2026 bridge incidents include the Verus Protocol Ethereum bridge ($11.6 million) and THORChain ($10 million on May 15). According to Peckshield, eight major cross-chain bridge attacks in May alone resulted in $328.6 million in combined losses.
The security data contextualizes the migration trend. Protocols are not switching from LayerZero to CCIP solely because of the Kelp exploit. They are switching because the exploit exposed a systemic question: what verification architecture should secure high-value cross-chain transfers? CCIP's answer — 16 independent node operators per bridge lane, SOC 2 Type 2 certification, and native rate-limit circuit breakers — appeals to protocols managing billions in TVL that cannot afford a single-point-of-failure configuration.
The cross-chain bridge migration has material implications for how economic value flows through Web3 infrastructure.
Bridge protocols extract fees from every cross-chain transfer. When $7.2 billion in assets shifts from one infrastructure provider to another, it redirects a fee stream that compounds with each transaction. CCIP's 213% QoQ fee revenue growth reflects not just organic volume growth but the capture of fee revenue previously flowing through LayerZero.
The shift also concentrates oracle and verification revenue. Chainlink's 16-node-operator model per bridge lane means node operators earn verification fees that previously accrued to LayerZero's DVN operators. With Chainlink claiming 99% oracle MEV market share and $16.7 million in SVR MEV recapture in Q1 alone, the economic moat around verification infrastructure is widening.
For protocols that migrated, the calculus is straightforward: the cost of a $292 million exploit dwarfs any savings from cheaper bridge fees. Security has become the primary variable in infrastructure procurement decisions, shifting value toward providers that can demonstrate audited, decentralized verification.
The $7.2 billion migration from LayerZero to CCIP is not a temporary dislocation. It represents a structural repricing of security in cross-chain infrastructure. The Kelp DAO exploit did not reveal a novel attack vector — bridge compromises have been endemic since 2022. What it revealed was that default configurations at the protocol level could leave billions in a single-verifier arrangement without the deploying project fully understanding the risk.
LayerZero's response — tightening DVN defaults to 5/5 minimum and publicly accepting responsibility — was substantive but came after weeks of blame-shifting that eroded institutional confidence. The protocol retains dominant volume share through legacy integrations, but new deployments and high-value migrations are trending toward CCIP.
The broader implication extends beyond two protocols. Bridge infrastructure is bifurcating into institutional-grade (audited, multi-validator, compliance-certified) and DeFi-native (fast, cheap, flexible) tiers. Protocols managing over $1 billion in cross-chain value are gravitating toward the former. The economic value previously distributed across lightweight verification networks is consolidating into heavier, more expensive, and more defensible infrastructure. Whether that consolidation improves net security outcomes or merely concentrates systemic risk in fewer providers remains an open question.