LAYERZERO FACES TRUST CRISIS AS NEARLY $2B MIGRATES TO CHAINLINK CCIP
LayerZero ($ZRO) has officially issued a public apology following weeks of intense community backlash regarding the $292 million rsETH exploit on KelpDAO. While the protocol admits to a "terrible job on communications" and technical oversights, the delay has triggered a massive "flight to quality," with major protocols abandoning LayerZero in favor of Chainlink’s Cross-Chain Interoperability Protocol (CCIP).
THE "SINGLE-VERIFIER" FATAL FLAW
The April 18, 2026 exploit, attributed to North Korea’s Lazarus Group, exposed a critical vulnerability in how LayerZero handles high-value transactions:
Infrastructure Compromise: Attackers gained control of internal RPC nodes and simultaneously launched a DDoS attack on external ones.
The 1-of-1 Trap: LayerZero admitted it should not have allowed its Decentralized Verifier Network (DVN) to act as the sole verifier for high-value transfers.
Default Configuration Dispute: While LayerZero initially blamed KelpDAO's setup, data revealed that nearly 47% of active LayerZero contracts were running the same risky 1-of-1 default configuration.
NEARLY $2B TVL EXODUS TO CHAINLINK CCIP
The slow response and lack of transparency have led to a significant drain on LayerZero’s ecosystem liquidity. Key migrations include:
KelpDAO (~$1.5B TVL): The first to depart, officially standardizing its cross-chain infrastructure on CCIP.
Solv Protocol (~$700M): Migrating its tokenized Bitcoin portfolio (SolvBTC/xSolvBTC), citing CCIP's "defense-in-depth" and multi-node validation.
Re & Huma Finance (~$600M+ combined): Selecting CCIP as their exclusive bridge for yield-bearing stablecoins (reUSD) and PST products.
LAYERZERO’S PATH TO RECOVERY
To stem the bleeding, LayerZero is implementing radical changes to its security model:
Mandatory Multi-Verification: Minimum of 3 to 5 verifiers for all pathways; 1-of-1 configurations are no longer supported.
OneSig Integration: Raising the multisig threshold from 3-of-5 to 7-of-10.