Theblock.Co Kraken Migrates to Chainlink CCIP Amid LayerZero Security Concerns
Article Content
- •Kraken has adopted Chainlink CCIP, abandoning LayerZero due to security concerns.
- •The Kelp DAO exploit, linked to Lazarus Group, resulted in a $292 million loss.
- •Over $2.5 billion has been lost to cross-chain bridge exploits since 2021.
Kraken has transitioned to Chainlink's Cross-Chain Interoperability Protocol (CCIP) from LayerZero, following a significant exploit involving Kelp DAO's rsETH token that resulted in a $292 million loss. This decision reflects growing concerns over the security of cross-chain bridges, with over $2.5 billion lost to such exploits since 2021. The Kelp DAO incident, attributed to North Korea's Lazarus Group, highlighted vulnerabilities in LayerZero's infrastructure, prompting Kraken and other firms to seek more secure alternatives. Chainlink CCIP offers enhanced security features, including a decentralized oracle network and independent risk management. Kraken's migration is part of a broader trend among crypto firms moving away from LayerZero due to its perceived security shortcomings. As a result, Chainlink's LINK token is expected to gain traction, while LayerZero's ZRO token may face challenges.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (15)
Following this threat?
Track Lazarus Group and Kelp DAO in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails… 
Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are…