Following the attack on the Kelp DAO bridge in April of this year, LayerZero faced a wave of massive infrastructure displacement. Public information indicates that Bitgo, Mantle, Kraken, Lombard, Solv Protocol and Wyoming State Stabilization Currency Project have announced a shift to Chainlink CCIP, which involves assets of nearly $15 billion in size.

The impact of the incident has gone beyond a single theft. The market is more concerned about whether the cross-chain security model will result in a reshuffle and whether LayerZero ' s share in the high-value asset bridge market will continue to decline.

The attack cost $292 million.

On 18 April, the rsETH cross-link bridge at Kelp DAO was attacked with false cross-chain messages, with approximately 11.65 million rsETH being transferred out, valued at approximately $292 million. Reports indicate that the attack took advantage of the weaknesses of the single-certifier configuration and was subsequently attributed to the Korean hacker organization Lazarus Group.

The stolen assets were subsequently deposited in Aave as collateral and loaned approximately $190 million in WETH, and the pressure was quickly transmitted to the lending market. Ave has since frozen rsETH associated pools on V3 and V4 to prevent the risk from spreading.

According to the article, the bridge configuration used by Kelp DAO is 1-of-1 DVD, i.e., relying on only one validation node to confirm cross-link messages. In the absence of a second certification party cross-checking, once that certification path has been breached, the target chain contract may release assets based on erroneous information.

The migration list continues to expand.

  • BitGo moves around $7.4 billion to Chainlink CCIP
  • Mantle Migration About $2.5 billion Super Portal
  • Lombard transferred more than $1 billion in bitcoin-related assets

In addition, Kraken states that Chainlink CCIP will be the sole bridge infrastructure for KBTC and subsequent encapsulation assets. Solv Protocol, Virtuals Protocol, Re, Yuzu Money have also joined the list.

On August 18, the Wyoming State Stabilization Currency Commission also finalized the relocation programme, choosing Chainlink CCIP as an exclusive multi-year infrastructure for Frontier Stable Token. The report mentions that Wyoming gave reasons including concerns about information disclosure and operational security at Layer Zero.

Security model differences are the focus.

Reports suggest that this round of migration is not only a response to a single attack but also reflects the differences between the two cross-chain security structures.

LayerZero V2 uses a configurable decentrized certification network, which allows the operator to choose the number and threshold of the certification. This design provides greater flexibility, but also means that the projecter may adopt a less secure configuration to reduce costs.

In contrast, each of the Chainlink CCIPs requires at least 16 independent node operators to participate in the validation, with a separate risk management network and a limitation mechanism based on the size of the asset. According to the article, the design raised the cost of the attack and provided additional buffers when the main certification layer failed.

The trend of concentration in the cross-chain infrastructure market is increasing with the shift of the Biggo equivalent asset issuer to the CCIP. For LayerZero, the larger question now is not just how to repair an attack, but how to restore confidence in its security model by large agreements and institutions.