LayerZero Loses $2B in TVL to Chainlink CCIP After Lazarus Group Exploit Confession

TLDR:

• LayerZero admitted its internal RPC was attacked by the Lazarus Group, exposing a critical security gap.
• Three protocols managing a combined $2B in TVL have confirmed migrations to Chainlink CCIP after the exploit.
• A 1/1 DVN misconfiguration created a single point of failure that left LayerZero vulnerable to attack.
• Major assets like Ethena’s USDe, Etherfi’s weETH, and Bitgo’s WBTC still rely on LayerZero’s OFT standard.

Multiple blockchain protocols are shifting away from LayerZero following a confirmed exploit and a public apology from the team.

Analyst Tom Wan reports that protocols with a combined total value locked (TVL) of approximately $2 billion have announced migrations to Chainlink CCIP.

KelpDAO leads the move with $1.5 billion, followed by SolvProtocol at $600 million and re at $200 million. The shift raises questions about LayerZero’s ability to retain clients.

Major Protocols Move Combined $2B TVL to Chainlink CCIP

The migration comes after LayerZero acknowledged serious security failures in a public statement. The team admitted that an internal RPC node was compromised by North Korea’s Lazarus Group.

More critically, LayerZero confessed to a 1/1 DVN misconfiguration that left the protocol with a single point of failure.

Tom Wan, a well-followed on-chain analyst, flagged the departures on X. He wrote that despite the apology, KelpDAO, SolvProtocol, and re had already announced moves to Chainlink CCIP. His post noted the combined TVL at risk and questioned whether an apology could stop further client losses.

The decision by these three protocols reflects growing concern over cross-chain infrastructure reliability. When a misconfiguration at that level is exposed, trust becomes difficult to rebuild quickly. Protocols managing billions in user funds are understandably cautious after such a disclosure.

LayerZero’s OFT Standard Still Holds Key Assets for Now

Despite the exits, several major token issuers continue to rely on LayerZero’s OFT standard. Ethena’s USDe and sUSDe, Etherfi’s weETH, Tether’s USDT0, Theo’s thBILL, and Bitgo’s WBTC remain on the protocol. These assets represent a substantial portion of cross-chain activity tied to LayerZero.

The retention of these names offers LayerZero some stability in the short term. However, their continued presence does not cancel out the reputational damage caused by the exploit. Any further incidents could accelerate additional departures from the protocol.

Chainlink CCIP, meanwhile, positions itself as a more secure alternative following this episode. The growing list of migrations adds to its credibility as an enterprise-grade cross-chain solution.

Whether this momentum continues will depend largely on LayerZero’s next steps in rebuilding confidence across the industry.

The post LayerZero Loses $2B in TVL to Chainlink CCIP After Lazarus Group Exploit Confession appeared first on Blockonomi.