LayerZero cuts 14 chains after KelpDAO exploit as Chainlink gains

LayerZero is pulling off-chain support from 14 low-activity chains within 30 days, a retreat that follows the $292 million KelpDAO exploit and hands more ground to rival Chainlink.

LayerZero will withdraw off-chain support for 14 low-activity chains within 30 days, cutting Arbitrum Nova and others after the $292 million KelpDAO exploit.

"We made a mistake by allowing our own verification network to secure high-value assets in a vulnerable setup," LayerZero said after the April attack, which drained rsETH from KelpDAO's bridge.

The affected networks' DVN (decentralized verifier network) and Executors, which handle off-chain communication between chains, will be deprecated by September. Some assets, including USDT and USDC stablecoins, could be stranded if not moved before the shutdown. Since July, LayerZero has flagged more than 30 chains with low activity, including the recently shut BounceBit.

The retreat is a strategic response to security risk and competition. Chainlink's Zach Rynes estimated that $15 billion has migrated from LayerZero to rival CCIP, and LayerZero's bridged volume dropped fourfold from about 400,000 ETH to roughly 100,000 ETH after the exploit.

The KelpDAO Fallout

The April exploit, one of the largest DeFi hacks of 2026, stemmed from LayerZero's recommended "1-of-1" DVN setup, which does not provide enough verification before large minting or fund transfers are approved. Since the same loophole can be used with low-adopted reserve assets, Aave has stopped supporting most of them, including ghost chains.

Several projects have since migrated from LayerZero to Chainlink's CCIP (Cross-Chain Interoperability Protocol). The Wyoming state government, BitGo (WBTC), and Nethermind have all moved. Nethermind, which runs one of Ethereum's most widely used execution clients powering more than a third of the network, is shutting down its DVN operations for LayerZero and joining Chainlink as a node operator securing CCIP and Data Feeds.

Chainlink's Growing Share

The migration wave extends beyond LayerZero's direct customers. KelpDAO itself moved to Chainlink after the exploit, and the Sandbox's SAND bridge on Base and BNB Smart Chain was hit in a separate incident involving LayerZero-powered infrastructure. On-chain security firm PeckShield flagged 14.9 billion SAND minted across two attacker addresses, roughly five times the token's 3 billion max supply, while Blockaid detected $49 billion in face-value unbacked SAND across more than 400 transactions.

Whether the chain removals are enough to stop top projects from leaving LayerZero remains to be seen. The firm has deep financial backing from Sequoia Capital, a16z, Binance Labs, and Coinbase Ventures, but the security questions raised by the KelpDAO exploit have given rivals a durable opening.

This article is for informational purposes only and does not constitute investment advice.