Crypto exchange Kraken announced Thursday that it has changed its cross-chain provider from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol (CCIP), joining a growing number of protocols making the move after the Kelp DAO exploit in April. The decision marks a significant shift in the cross-chain landscape, as security concerns continue to drive protocols toward more hardened infrastructure.

Kraken said it is deprecating its existing cross-chain provider and migrating to Chainlink CCIP as its exclusive cross-chain infrastructure to secure Kraken Wrapped Bitcoin (kBTC) and all future wrapped tokens. The company added that it chose Chainlink CCIP because it “offers enterprise-grade infrastructure with strict security and risk management requirements.” These include certifications, a secure-by-default design, 16 independent nodes, and native rate limits.

The Kelp DAO exploit that triggered the exodus

LayerZero has been under intense scrutiny since the Kelp DAO exploit in April, in which approximately $292 million in liquid restaking tokens were stolen by actors suspected to be linked to North Korea’s Lazarus Group. The attack exploited vulnerabilities in LayerZero’s messaging protocol, specifically targeting a single-DVN (Decentralized Verifier Network) setup used by Kelp DAO.

LayerZero issued an “overdue apology” on May 9, acknowledging that it had done a “terrible job on comms over the past three weeks.” The protocol admitted that its internal RPCs (remote procedure calls) were attacked and had their “source of truth poisoned” while its external RPC providers were simultaneously hit with a denial-of-service attack. However, it placed partial blame on Kelp’s configuration, which relied on a single-DVN setup rather than the recommended multi-DVN architecture.

Despite the incident, LayerZero confirmed that no other application had been affected, and more than $9 billion in bridged assets have been moved using the protocol since April 19. Nevertheless, the damage to trust had already been done.

Why Chainlink CCIP is winning over protocols

Chainlink CCIP has emerged as the go-to alternative for protocols seeking robust cross-chain security. Designed from the ground up for enterprise use, CCIP incorporates multiple layers of defense, including a decentralized oracle network, risk management modules, and independent node operators. Unlike LayerZero, which relies on third-party DVNs and user-chosen configurations, CCIP enforces a standardized security model that minimizes human error.

Lido, the world’s largest Ethereum liquid staking protocol, also uses CCIP and has praised its security posture. “Chainlink’s defense-in-depth model acts as the definitive standard for cross-chain interoperability,” Lido explained in a blog post on Thursday. The protocol highlighted that CCIP’s 16 independent nodes and automated rate limits prevented runaway exploits that might otherwise drain funds.

Kraken’s decision underscores the growing preference for battle-tested infrastructure in the wake of high-profile hacks. By moving kBTC and future wrapped tokens to CCIP, Kraken aims to provide its users with a safer bridging experience.

Other protocols join the migration wave

Kraken is not alone. Several other major protocols have announced migrations from LayerZero to Chainlink CCIP in recent weeks:

• Kelp DAO stated it is in the process of migrating to Chainlink CCIP. It also burned the hacker’s 117,132 rsETH as part of the recovery process this week, and is eyeing reopening withdrawals soon.
• Solv Protocol announced on May 7 that it was migrating from LayerZero to CCIP as its official cross-chain infrastructure for $700 million in tokenized Bitcoin.
• Re, an onchain reinsurance protocol, announced on May 8 that it was migrating its $475 million in total value locked from LayerZero to Chainlink CCIP.

According to MEXC, more than $3 billion in TVL has been migrated to CCIP since the Kelp hack, while numerous protocols have suspended bridging using LayerZero altogether. The chain migration highlights how a single exploit can reshape the competitive dynamics of the cross-chain ecosystem.

Market reaction and token price impact

Despite the positive news for Chainlink, the price of its native token LINK showed little reaction. LINK remains at a bear market low of around $10, down 80% from its 2021 peak. Analysts suggest that the migration trend reinforces Chainlink’s long-term utility, but near-term price action is more influenced by broader macroeconomic factors and Bitcoin’s decline.

In contrast, LayerZero’s native token ZRO has suffered heavily. Since the April hack, ZRO has declined over 30%, and it is now down more than 80% from its 2024 all-time high, according to CoinGecko. The depreciating token reflects the erosion of trust in the protocol’s security model.

CoinGecko data shows ZRO trading at $0.23, while LINK is at $9.51 as of the time of writing. Bitcoin was trading at $76,919, Ethereum at $2,120, and Solana at $84.90.

Technical comparison: CCIP vs LayerZero

The two protocols differ fundamentally in their approach to cross-chain messaging. LayerZero operates as a permissionless, configurable messaging layer where applications can choose their own DVNs and adapters. While flexible, this flexibility introduces risk if users misconfigure settings, as seen in the Kelp DAO incident.

Chainlink CCIP, on the other hand, enforces a strict security model with multiple independent nodes, a rate-limiting mechanism, and a dedicated risk management network that can pause operations if anomalies are detected. Lido’s comparison of CCIP and LayerZero emphasized that CCIP’s “defense-in-depth” approach provides a higher baseline of security for large-scale financial applications.

For protocols managing hundreds of millions or billions of dollars, the trade-off between flexibility and security has tilted decisively in favor of security post-exploit.

LayerZero’s response and future outlook

LayerZero has acknowledged the shortcomings exposed by the exploit and has taken steps to improve communications and security. The team has urged all applications to move away from single-DVN configurations and to adopt multi-DVN setups. However, the damage to its reputation may take time to repair.

Cointelegraph reached out to LayerZero for comment but did not receive an immediate response. Industry observers note that LayerZero still processes significant bridging volume, but the loss of high-profile clients like Kraken, Solv, and Re could be a tipping point.

Meanwhile, Chainlink is capitalizing on the moment. With more than $3 billion in new TVL migrating to CCIP, the protocol is cementing its position as the preferred cross-chain solution for institutions and large DeFi players. Kraken’s endorsement further lends credibility, given the exchange’s substantial user base and asset custody responsibilities.

As the cross-chain wars continue, the incident serves as a stark reminder that security failures can have immediate and lasting consequences. Protocols that prioritize robust, audit-ready infrastructure are likely to attract higher-value assets and partnerships.

The broader ecosystem is watching closely. With billions of dollars in bridged assets at stake, the next exploit could reshape the market even further. For now, Chainlink CCIP appears to have the momentum.

Source: Cointelegraph News