KelpDAO Moves rsETH to Chainlink After LayerZero Exploit

KelpDAO and Ethena Challenge LayerZero’s Explanation

KelpDAO said: “After the recent LayerZero exploit, we are taking steps to ensure rsETH is fully secure, which is why we are migrating to Chainlink CCIP.” KelpDAO also said “from the April 18 incident, it is clear that LayerZero’s own infrastructure was exploited, resulting in $300M in losses across DeFi.”

KelpDAO said its “number-one priority remains the security of our users’ assets,” citing Chainlink’s seven-year track record and decentralized oracle network as reasons for moving rsETH to Chainlink CCIP and the Cross-Chain Token standard.

Ethena publicly framed the exploit differently from both LayerZero and KelpDAO, describing the issue as a verification design problem rather than solely an infrastructure compromise. Ethena said the exploit combined a 1-of-1 DVN configuration with compromised RPC infrastructure, allowing forged cross-chain messages to be validated and executed.

Ethena said low-quorum setups create critical single points of failure. Ethena also said its own architecture avoided similar exposure by requiring higher verification thresholds alongside safeguards including rate limits and restricted bridge routes.

Ethena said it paused its LayerZero bridges within hours of detecting anomalies and said USDe remained fully backed and unaffected.

LayerZero said on April 20 that the exploit resulted from a single point of failure in KelpDAO’s implementation, which relied on a single LayerZero DVN as the only verified path despite prior warnings against that configuration.

Arbitrum DAO Recovery Plan Faces Court Challenge

The recovery process later expanded into Arbitrum governance after the Arbitrum Security Council froze ETH that the KelpDAO attacker had moved to an Arbitrum One address on April 20. Those frozen funds were subsequently moved to an address controlled by the protocol.

Arbitrum DAO later voted to release 30,765.6 ETH, worth about $70 million, to the DeFi United initiative formed to coordinate restitution efforts following the exploit.

The proposal received 182.2 million votes in support, representing 90.96% of all voting power, while around 9% of voters abstained. With the approval, Arbitrum was positioned to become the largest donor to DeFi United.

Support cited for DeFi United included 30,000 ETH from Consensys and Joseph Lubin, a 30,000 ETH loan from Mantle, and 5,000 ETH from LayerZero.

The attacker had moved a significant portion of the stolen rsETH to Aave as collateral for WETH, creating roughly $190 million in bad debt for Aave.

The recovery effort then encountered legal complications after a May 1 court order restricted Arbitrum DAO from moving the recovered funds. The order was filed by multiple plaintiffs tied to separate years-old terrorism judgments against North Korea, with those plaintiffs seeking to claim the frozen ETH as restitution.

Crypto attorney Gabriel Shapiro said: “Arbitrum DAO is not allowed to do anything with the KelpDAO funds for now, until a divestiture hearing.”

Aave LLC filed an emergency motion in federal court challenging the order. Aave LLC argued the ruling was based on unproven speculation that the exploit was carried out by North Korea’s Lazarus Group. Aave LLC also argued that even if Lazarus had conducted the exploit, temporary possession of stolen assets would not constitute ownership.

The attacker was described as suspected to be Lazarus Group, though that attribution remained contested in the legal proceedings.

Solv and Tydro Shift Toward Chainlink Infrastructure

A separate May 8, 2026 release said multiple DeFi protocols had begun reassessing oracle and bridge providers following the KelpDAO exploit.

Solv Protocol announced on Thursday that it would migrate to Chainlink’s Cross-Chain Interoperability Protocol and replace LayerZero bridges. Solv said an “extensive security review” concluded CCIP provided the “strongest security assurances.”

The migration involves more than $700 million worth of tokenized BTC products, including SolvBTC and xSolvBTC, moving from LayerZero to Chainlink CCIP.

Tydro said one day before Solv’s announcement that it was also moving to Chainlink infrastructure after an incident involving its previous oracle provider, Chaos Labs, prompted the protocol to pause markets over concerns about inaccurate price feeds.

RedStone was later contacted by Tydro as an emergency measure after the Chaos Labs oracle attack and provided support to help restore oracle feeds.

Zach Rynes, strategic initiatives lead at Chainlink Labs, said the KelpDAO exploit triggered a “wake-up call” for DeFi providers. Rynes said DeFi teams conducting security reviews are increasingly deciding to replace older oracle and bridge systems with Chainlink infrastructure to strengthen baseline security protections.

Rynes also said multiple other DeFi protocols were discussing potential migrations to Chainlink after the exploit.

Marcin Kazmierczak, co-founder of RedStone, said oracle providers with long operating histories and strong reliability are becoming increasingly important as hacks continue across the sector. Kazmierczak added that RedStone had maintained a “fully reliable track record.”

Kazmierczak said only a smaller group of specialized providers may be able to meet the “demand and reliability requirements” created by growing institutional participation in DeFi.

He said: “A smaller set of trusted oracles is forming in the market.”

When asked about concentration risk from many DeFi protocols relying on fewer providers, Rynes said Chainlink infrastructure was designed to withstand extreme market conditions. Rynes pointed to the 2020 Covid market crash, the 2022 FTX collapse, and major volatility events in 2025 as periods when Chainlink continued operating through disruption.

Nik Kunkel, founder of Chronicle, warned that overreliance on a single infrastructure provider creates additional risk.

Kunkel said: “There are risks anytime a large portion of an ecosystem depends on a single piece of infrastructure.”

LayerZero Multisig Activity Draws Security Criticism

Another May 8, 2026 release said heated debate erupted in the “ETH Security Community” Telegram channel between LayerZero’s Bryan Pellegrino and community security researchers.

Security researchers claimed more than $3 billion in LayerZero OFTs were, until recently, dependent on a default library contract that LayerZero Labs could upgrade instantly without a timelock.

Researchers argued the default library structure could theoretically allow forged cross-chain messages resembling the same vulnerable setup involved in the KelpDAO exploit.

Yearn contributor banteg said major protocols including Ethena and EtherFi were still relying on the default library configuration only weeks before the Telegram dispute despite risks tied to centralized upgrade control.

Researchers also claimed that although many teams had migrated away from LayerZero’s default security standards after the exploit, $178.5 million remained exposed in projects still using the default library setup instead of moving to immutable or independently governed configurations.

James Prestwich said LayerZero multisig signing keys were used to trade “McPepes” memecoins and conduct other personal transactions, suggesting the keys were tied to day-to-day addresses used by internal LayerZero contributors.

Bryan Pellegrino responded that the signers involved had already been removed from the multisig and said any memecoin-related activity was connected to official team tests. James Prestwich rejected Pellegrino’s explanation that the transactions were merely OFT testing.

A separate May 8 release said LayerZero’s production 2-of-5 Gnosis Safe multisig keys were observed executing Uniswap trades involving the McPepes memecoin.

The accusations focused on LayerZero’s 2-of-5 Gnosis Safe multisig, which was described as securing user tokens and controlling key portions of LayerZero’s OFT infrastructure.

Screenshots from an internal discussion that circulated on X allegedly showed that three of the five Gnosis Safe signers participated in activity unrelated to multisig operations.

One signer address, 0x1f5E377a3ADBe6f3289ADb6b21eae6427dfbb553, was associated with trading PEPES/McPepes and activity on Hop. Another signer address, 0xBb6633c267951E938F9B6421E4F54aa5b2c19326, reportedly held approximately $12 million and engaged in Stargate staking. A third signer address, 0x6fC8342C448F9a8d541C17579EF7A14237b8d5aD, was described as participating in liquidity provisioning on Curve, PancakeSwap, and SpookySwap.

A March 1, 2023 transaction allegedly exchanged 0.198548073 ETH for approximately 1.73 million McPepes/PEPES ERC-20 tokens through Uniswap V3.

Critics said the transaction showed production keys safeguarding billions of dollars were linked to external websites and potentially exposed to phishing attacks. The multisig reportedly lacked a timelock, the keys reportedly remained stagnant for several years, and the same parties were described as controlling multisig-managed DVN settings and libraries for LayerZero-compatible protocols.

The allegations described the risk as particularly severe because only two stolen keys would have been sufficient to empty the 2-of-5 multisig.

Pellegrino said the wallets involved were no longer connected to signatory functions and denied the activity constituted “memecoin trading,” saying the transactions were related to OFT testing rather than speculation.

Critics challenged that explanation because the transaction involved McPepes rather than PEPE and because ETH-to-memecoin swaps through Uniswap appeared difficult to classify as OFT testing.

No public audit or complete rebuttal addressing all prior signer activity had been released in the available information.

Zach Rynes criticized the alleged key-management practices as “horrific opsec” and warned the behavior was dangerous for users operating LayerZero under default settings.

Rynes wrote: “I genuinely wish I were joking, it’s horrifying what passes for ‘opsec’ in this industry.”