Kelp DAO Ditches LayerZero for Chainlink CCIP After $292M Exploit
Kelp DAO has announced it will migrate its restaking token rsETH to Chainlink’s Cross-Chain Interoperability Protocol following the April 18 exploit that drained 116,500 rsETH tokens worth approximately $292 million from its LayerZero-powered bridge. The move escalates a public dispute over who bears responsibility for one of 2026’s largest DeFi security failures. Chainlink (LINK) was trading at $9.88, up 2.89% in the past 24 hours, as the migration news circulated.
Kelp and LayerZero Trade Blame Over Bridge Configuration
Kelp DAO stated on X Tuesday that the attackers exploited a vulnerability in its LayerZero bridge setup, specifically a 1-of-1 DVN (decentralized verifier network) configuration that required only a single independent check to validate cross-chain transactions. “After the recent LayerZero exploit, we are taking steps to ensure rsETH is fully secure, which is why we are migrating to Chainlink CCIP,” the protocol wrote. Kelp argues this configuration is the platform default, citing Dune analytics data showing roughly half of LayerZero users operate with a single DVN.
LayerZero CEO Bryan Pellegrino directly rejected that framing. He stated on X that “a ton” of Kelp’s claims were “just completely untrue,” arguing that rsETH was originally configured to use LayerZero’s multi-DVN default combining LayerZero Labs and Google verification, and that Kelp later manually downgraded to a 1-of-1 setup not recommended for production applications. Pellegrino added that an external security firm postmortem will be published shortly. On the core factual question of who changed the configuration, The Block’s reporting suggests Pellegrino’s account carries more technical weight, given LayerZero’s documented policy change post-exploit to reject single-DVN setups entirely.
Aave Fights Court Freeze on $71M in Recovered ETH
The exploit’s legal fallout deepened this week on a separate front. Aave filed an emergency motion on May 4 to vacate a restraining notice freezing $71 million in ETH that had been recovered following the attack, funds the protocol intends to return to affected users. The freeze stems from a competing legal claim by attorneys representing victims of three North Korea terrorism cases, who filed a 30-page response Tuesday reframing the April 18 hack as fraud rather than theft, a distinction that could theoretically give the attackers legal title to the borrowed crypto under certain interpretations. Aave (AAVE) was trading at $94.53, up 1.46% on the day, as the emergency motion drew attention.
The legal argument is aggressive and the outcome is unconfirmed. What is confirmed: Aave wants a fast ruling so restitution to its users can proceed, and attorneys for the terrorism victims are pushing back hard. Arbitrum’s Security Council, which used emergency powers to freeze the stolen funds, is now indirectly caught between two sets of claimants with entirely different legal theories. As our earlier coverage of the initial $292M bridge exploit documented, the contagion from this single attack continues to ripple across protocols, courts, and governance systems simultaneously.
The infrastructure lesson here is direct: redundant verification is not optional in production cross-chain systems, and the cost of skipping it is now measured in nine figures and counting. Kelp’s migration to Chainlink CCIP is a corrective step, but the dispute over who approved the vulnerable configuration still needs a definitive answer before the industry can draw the right conclusions.
