Crypto projects with a total value of more than $3 billion have migrated their cross-chain infrastructure to Chainlink’s Cross-Chain Interoperability Protocol (CCIP) following a $292 million exploit at KelpDAO, which increased oversight of bridge security within the decentralized finance sector.
Chain link confirmed the migration wave, where it was said that four protocols, including KelpDAO, Solv Protocol, Re, and Tydro, had begun dismantling old oracles and bridge systems in favor of CCIP.
The shift has also contributed to LINK’s market performance. CryptoSlate Data shows the token rose 15% to $10.52, its highest level since January, as traders reacted to the acceleration of CCIP adoption.
Blockchain analytics company Santiment said the rally was accompanied by a tightening of the available supply of LINK on the stock exchanges. According to the company, LINK’s foreign exchange reserves fell by LINK 13.5 million in five weeks, representing more than 10.5% of the stock held on the exchange recorded in early April.
The price move reflects a broader reassessment of Chainlink’s role in crypto infrastructure. After years of being best known for price feeds and oracle services, the network is now becoming a direct beneficiary of DeFi’s quest for more secure cross-chain rails.
Why DeFi Protocols Are Embracing Chainlink’s CCIP?
Cross-chain bridges allow tokens, NFTs, and data to move between otherwise separate blockchain networks. This means that these platforms allow users to shift liquidity between ecosystems, such as moving assets from Ethereum to Solana, without having to rely on a centralized exchange.
That feature has become essential as DeFi has spread across multiple blockchains. Lending markets, staking tokens, stablecoins and tokenized assets increasingly rely on infrastructure that can move value between networks without fragmenting liquidity or locking users into a single chain.
However, bridges have also become one of the most attacked infrastructure components of crypto. This is because they often rely on complex authentication systems and have large amounts of locked assets, making them attractive targets for hackers.
Chainalysis has described cross-chain bridges as one of the blockchain industry’s biggest security risks. By 2022, more than $2 billion had been stolen through thirteen bridge hacks, with North Korea-affiliated groups among the most active attackers.
That history has pushed DeFi protocols toward infrastructure that can provide more standardized security controls. Chainlink’s CCIP, which launched on Mainnet in July 2023, has become one of the main beneficiaries of that shift.
CCIP uses Chainlink’s decentralized oracle networks, the same infrastructure behind the data feeds that secure large parts of DeFi. Chainlink says these networks now include more than 2,000 decentralized oracle networks in production, securing more than $110 billion in value and powering more than 70% of DeFi.
Unlike many traditional bridges, which can rely on a limited number of validators or verification paths, CCIP is designed to transmit both data and token value across chains via Chainlink’s oracle infrastructure.
That gives protocols a way to move assets while reducing dependence on custom bridge designs.
For protocols that manage hundreds of millions of dollars in assets, cross-chain infrastructure is now viewed less as back-end plumbing and more as a core part of risk management.
LayerZero tries to limit the consequences
Meanwhile, the migration wave has put pressure on LayerZero, the cross-chain platform previously used by KelpDAO, to explain its role in the $292 million breach.
LayerZero has one apology on May 9, about three weeks after the April 18 breach. The company acknowledged that post-operation communications were lacking and admitted that its security model allowed a high-end application to operate with insufficient safeguards.
LayerZero had initially maintained that the infrastructure was working as designed and that the responsibility lay with the application configuration.
However, its more recent comments struck a different tone, acknowledging that it should have exercised stronger oversight over how its decentralized verification network was used.
The company said it “made a mistake” by allowing its Decentralized Verifier Networks (DVNs) to function as the sole verifier for high-value cross-chain transactions without adequate guardrails.
It was noted:
“We failed to monitor what our DVN was securing, creating a risk we simply did not see. That is our property.”
The confession goes to the heart of the dispute. LayerZero’s architecture gives application developers the flexibility to configure authentication as they see fit. That customizability has long been part of the protocol’s appeal, especially for teams seeking more control over their cross-chain security assumptions.
The KelpDAO exploit exposed the weakness of this approach when teams are working with too limited an authentication setup. If an application relies on a single authenticator, a compromise at that layer can pose a direct threat to users’ resources.
Meanwhile, LayerZero also disclosed a previously unreported incident from three years ago involving one of its multisig signatories.
The company said the signer accidentally used LayerZero hardware to conduct an in-person transaction. The signer was removed, wallets were rotated, and LayerZero was later moved to a custom multisig framework.
The disclosure appeared intended to demonstrate that the protocol had addressed previous internal security shortcomings. However, it also added an extra layer of control at a time when customers were already reassessing their exposure.
LayerZero said the KelpDAO exploit affected only a single application, representing 0.14% of network applications and approximately 0.36% of the protocol’s total value. It also said that no other application was affected.
That defense leaves LayerZero with a narrow but difficult argument. The company is trying to show that the exploit was isolated, while also admitting that the configuration should not have secured so much value without stronger oversight.
Can LayerZero restore institutional trust?
The key question now is whether LayerZero’s apology and technical explanation can delay the migration of protocols to Chainlink.
Tom Wan, head of data at Entropy Advisors, questioned whether the damage to institutional trust had already been done. He wrote
“Can an apology keep their customers from moving to Chainlink, or is this just the beginning?”
LayerZero has tried to answer that concern with usage data. The company said more than $9 billion has passed through its infrastructure since the April attack, a figure intended to show that users and applications continue to rely on the protocol despite the KelpDAO incident.
Wan also noted that several key assets, including USDe, WBTC and weETH, remain active on LayerZero.
That continued use suggests the protocol has not lost complete trust, even as several prominent projects move parts of their cross-chain stack elsewhere.
LayerZero also has defenders who argue that the protocol’s flexibility remains its main advantage.
In that perspective, adaptability in itself is not a defect. The risk arises when application teams fail to match their security configuration with the volume of capital flowing through their systems.
Lorenzo Romagnoli, co-founder of USDT0, said The LayerZero model requires asset issuers to take security seriously from the start. USDT0, the largest asset on the LayerZero network, has moved $4 billion between chains without incident.
Romagnoli said:
“LayerZero is the gold standard for cross-chain interoperability due to its high level of customizability. Unfortunately, this means application owners must invest serious resources to meet the security standard that the capital moving through our rails requires.”
Romagnoli said USDT0 operates its own veto-powered DVN, with invariance checks tailored to its specific risk profile. He argued that the protocol remained unaffected because it treated security as part of the product, rather than as a feature automatically inherited from the underlying rails.
This defense encompasses the broader debate that cross-chain infrastructure currently faces. Protocols want flexibility, but they also need contingencies and guardrails strong enough to protect large amounts of user capital. The KelpDAO exploit has made this trade-off harder to ignore.
For Chainlink, the wave of migration strengthens CCIP’s position as a security-focused cross-chain standard as DeFi teams reassess vendor risk.
For LayerZero, the challenge is to demonstrate that the adaptable model can meet institutional expectations without exposing high-performance applications to weak configurations.