Loading article…
Kelp DAO is migrating to Chainlink CCIP following a $292 million exploit of its cross-chain bridge, highlighting ongoing security risks in DeFi protocols.
The decentralized finance (DeFi) sector has faced a turbulent 2026, highlighted by an April 18 exploit of Kelp DAO that resulted in the theft of approximately 116,500 rsETH, valued at roughly $292 million [1]. The attack, which targeted the protocol's cross-chain bridge, stands as one of the largest security breaches of the year and has prompted a significant shift in the project's technical infrastructure [1].
Key takeaways
Following the breach, Kelp DAO announced on May 5 that it would replace its existing LayerZero infrastructure with Chainlink’s CCIP [2]. The protocol’s leadership maintains that the root cause of the incident was the underlying infrastructure of the bridge rather than internal protocol errors [2]. Independent firms, including SEAL 911 and Chainalysis, reportedly traced the breach to LayerZero’s systems, which the project claims led to total ecosystem losses exceeding $300 million [2].
The migration to Chainlink is intended to address the architectural risks exposed by the attack [2]. Unlike the previous setup, Chainlink CCIP requires consensus from 16 independent node operators for every transaction, a design intended to eliminate the single-point-of-failure risks that allowed the April exploit to occur [2]. Technical preparations for this transition are already underway, with new CCIP-compatible contracts appearing in the project's public repositories [2].
The Kelp DAO incident is part of a wider trend of DeFi protocols struggling with structural weaknesses in bridges and administrative systems [1]. In the first five months of 2026, over $840 million has been lost to such hacks, with April alone accounting for more than $600 million in stolen funds [1]. Experts note that attackers are increasingly using social engineering and AI-assisted reconnaissance to identify vulnerabilities in smart contracts and administrative keys [1].
The scale of the Kelp DAO exploit triggered a massive $6.2 billion wave of withdrawals from the lending platform Aave, necessitating a coordinated industry recovery effort known as "DeFi United" to backstop the resulting bad debt [1]. The incident underscores a growing consensus among security professionals that in the blockchain space is a "full-stack problem" that requires addressing human processes alongside technical code audits [1]. As protocols like Kelp DAO move toward more robust, multi-party validation systems, the industry continues to grapple with the reality that cross-chain complexity remains a primary target for sophisticated state-linked actors [1].
Coverage is mostly measured — 60 of 75 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 1, 2026 ·
A DAO is a decentralized autonomous organization that uses blockchain-based software and smart contracts to manage organizational processes like voting and finance.
The legal status of DAOs is generally unclear and varies by jurisdiction, though some states like Wyoming have introduced legislation to recognize them as legal entities.
Because DAO code is difficult to alter once live, fixing security holes often requires writing new code and reaching an agreement to migrate all funds to a new system.
Voting power is typically coordinated through governance tokens or NFTs, where holding a larger quantity of tokens often translates to greater influence over organizational decisions.