Kelp DAO announced migration of its rsETH token to Chainlink CCIP on May 6, 2026, following a $292 million exploit in April that exposed fundamental disagreement over cross-chain bridge security defaults. The move represents a direct loss of confidence in LayerZero’s infrastructure and intensifies a public dispute with LayerZero co-founder Bryan Pellegrino over whether the protocol’s decentralized verifier network (DVN) configuration was adequately secured.
How the April Exploit Exposed DVN Configuration Risk
On April 18, attackers stole 116,500 rsETH tokens via LayerZero’s bridge, then used the tokens as collateral on Aave v3 to borrow wrapped Ether. The breach centers on a critical technical disagreement: Kelp DAO claims it used LayerZero’s default single-DVN configuration, while Pellegrino insists the protocol’s standard setup requires a multi-DVN architecture for security. Kelp states LayerZero confirmed this configuration as secure multiple times. LayerZero’s postmortem followed within a day of the exploit, but an external security firm audit remains unpublished as of May 6.
Chainlink CCIP Emerges as Safer Alternative
Kelp’s decision to migrate to Chainlink CCIP reflects broader market concerns about LayerZero’s default security posture. Dune analytics data cited by Kelp shows approximately 50% of LayerZero users operate with single-DVN setups, suggesting the configuration is either widely adopted or commonly misunderstood. Pellegrino disputes the relevance of this comparison, claiming single-DVN requires manual deviation from LayerZero’s safer defaults. Chainlink has not yet released specific details about the migration terms or security guarantees for rsETH on CCIP.
DVN Configuration Becomes Industry Battleground
The dispute signals deeper uncertainty about cross-chain infrastructure security standards. LayerZero now mandates multi-DVN configuration for all applications following the exploit, effectively admitting that single-DVN represents unacceptable risk. Kelp’s public statement that LayerZero “confirmed as secure” the configuration used in the breach contradicts Pellegrino’s account that Kelp made an active choice to deviate from safer defaults. This disagreement over responsibility will likely shape how other protocols evaluate LayerZero versus competitors like Chainlink, Wormhole, and Axelar.
Migration Deadline and Unresolved Questions
Kelp DAO has not disclosed a hard deadline for completing the CCIP migration or detailed technical specifications for the bridge upgrade. The external security postmortem that LayerZero promised remains unreleased, leaving the technical record incomplete. Until both the full audit and Chainlink’s implementation details emerge, the exploit’s root cause—protocol design flaw, user misconfiguration, or both—will remain contested in the DeFi community.
