Kelp DAO moves rsETH bridge from LayerZero to Chainlink CCIP after $292M hack

Kelp DAO says it is migrating its rsETH liquid restaking token bridge from LayerZero OFT to Chainlink CCIP after the April 18 attack that drained 116,500 rsETH and triggered about $292 million in DeFi losses. The report links the exploit to a “single validator” bridge setup. Attackers allegedly abused compromised network RPC nodes and used DDoS-style traffic redirection to route requests to “poisoned” nodes, enabling forged signatures to release tokens on the destination chain without the expected upstream burn—leaving rsETH exposed and nearly 18% of circulating rsETH affected. Kelp DAO disputes LayerZero’s claim that the configuration violated best practices, saying LayerZero personnel approved the single-validator design. LayerZero later banned the setup and pushed migrations for affected applications. Why Chainlink CCIP: CCIP is positioned as a security-first, multi-layer architecture with separate oracle networks and risk-management code paths, aimed at reducing blast radius from single-path failures. CCIP is also noted as having no major security incidents since launch. After the hack, LayerZero pledged 10,000 ETH to recovery and Arbitrum froze 30,766 ETH from attacker-linked wallets, though US legal efforts remain unclear. For traders, the key takeaway is ongoing cross-chain bridge risk: the rsETH infrastructure change may improve perceived safety, but near-term sentiment will likely hinge on whether more bridge exploits surface.