Crypto exchange Kraken is deprecating its LayerZero-powered infrastructure and migrating to Chainlink to secure its Kraken Wrapped Bitcoin (kBTC) product, according to an announcement on Thursday.
With this move, Kraken has become at least the fourth crypto firm or project to deprecate its LayerZero cross-chain channels following the massive Kelp DAO attack last month, which some onlookers attributed to LayerZero’s lax security standards.
This includes migrations from Kelp DAO itself, Bitcoin DeFi platform Solv Protocol, and Re, an onchain reinsurance protocol. Those protocols represent a combined $2.57 billion in total value locked, a Chainlink representative told The Block. KBTC has about $333 million TVL, according to DeFiLlama.
Kraken said it tapped Chainlink’s Cross-Chain Interoperability Protocol (CCIP) "because it offers enterprise-grade infrastructure with strict security & risk management requirements."
Notably, CCIP requires 16 independent node operators to validate cross-chain transactions. It also features native rate limits and ISO 27001 and SOC 2 Type 2 certifications, Kraken said.
Kraken said Chainlink will support "all future Kraken Wrapped Assets." The exchange integrated LayerZero's OFT standard in 2025 to make kBTC portable across over 150 chains. LayerZero-powered USDT0 stablecoin also tapped Kraken's Ink blockchain as its first deployment.
"Kraken’s unwavering commitment to uncompromising security aligns perfectly with principles that shaped CCIP’s architecture," Chainlink Chief Business Officer Johann Eid said. "By deprecating its legacy infrastructure and adopting CCIP, Kraken is ensuring its assets can move seamlessly across networks while maintaining the institutional-grade security that enterprises require to bring significant capital."
Blame game?
Some security experts have blamed LayerZero for the $292 million Kelp DAO bridge exploit. According to an incident report, attackers likely linked to North Korea’s Lazarus Group exploited Kelp’s LayerZero-powered bridge, which was set up in a single-verifier configuration.
LayerZero initially deflected blame — arguing it had recommended Kelp to move to a more robust verification standard to require more than one signer to approve bridge transactions — but has since accepted a degree of blame for poor communication.
According to an analysis following the Kelp DAO exploit, some 47% of the applications running LayerZero tech operated using a single-verifier configuration, bolstering Kelp's argument that this was LayerZero’s default.
LayerZero has since begun rolling out infrastructure and operational improvements, and will no longer support 1/1 Decentralized Verifier Network configurations.
The crypto community has rallied in support following the Kelp DAO attack, having raised over $320 million via the DeFi United campaign to help restore the backing of rsETH and make effected parties whole.
A Chainlink spokesperson noted that over $3 billion in TVL has flowed to Chainlink in recent weeks, including the migrations from LayerZero and a similar move from Tydro, the primary lending protocol on the Kraken-supported Ink blockchain.
Last week, Tydro said it would deprecate its Chaos Labs oracles "out of an abundance of caution" following some anomalous behavior.