Kelp DAO to migrate rsETH to Chainlink CCIP as blame game continues

Kelp DAO announced it is migrating its liquid restaking token rsETH off LayerZero’s OFT standard and onto Chainlink’s Cross‑Chain Interoperability Protocol (CCIP), calling the change a security hardening step after an April bridge drain that released roughly 116,500 rsETH (about $292–293 million). The move comes amid an escalating public dispute over where responsibility for the incident lies.

The exploit took place on April 18, when an attacker engineered forged cross‑chain messages to free rsETH from the protocol’s LayerZero‑based bridge, then used those tokens as collateral in lending markets. Bloomberg reported the event as one of 2026’s largest DeFi security incidents and described the ripple effects across lending and cross‑chain liquidity. LayerZero’s April post‑mortem pointed to an RPC/node poisoning vector coupled with a single‑verifier (1‑of‑1 DVN) configuration, while Kelp published screenshots and GitHub updates arguing the configuration was documented and had been approved in prior communications.

The incident depressed sentiment around LayerZero‑linked infrastructure and put selling pressure on associated tokens, with ZRO falling amid the fallout. Lending markets reacted quickly: Aave and other platforms paused rsETH markets or tightened controls to limit contagion, producing short‑term liquidity strains for counterparties and users exposed to rsETH collateral. Traders and risk desks reassessed bridge exposure across multiple DeFi stacks.

In broader context, investigators and several analytics firms have preliminarily linked the operation to the Lazarus Group, amplifying geopolitical as well as technical concerns for custodial and non‑custodial infrastructure. The episode has accelerated industry discussions on standardized multi‑verifier architectures, on‑chain risk management layers and the role of third‑party oracle/verification networks in cross‑chain settlement.

Market observers say migrating to Chainlink CCIP should materially reduce single‑point‑of‑failure risk because CCIP uses multiple independent validator/Oracle networks and separate risk‑management lanes; however, full confidence depends on transparent audits and the publication of joint post‑mortems by involved parties. For now, the sector expects stricter onboarding checks, broader adoption of multi‑DVN setups and deeper third‑party audits before capital fully returns to similar cross‑chain primitives.