Kelp Blames LayerZero for $292M Exploit, Jumps to Chainlink Oracles

Kelp just accused LayerZero of letting hackers drain $292 million from its platform. The DeFi protocol didn’t mince words.

The attack hit through what Kelp calls vulnerabilities in LayerZero’s cross-chain messaging system. Attackers basically found a way to pull funds across chains without proper validation, and the money disappeared fast. Kelp said the exploit happened because LayerZero’s protocol didn’t catch the malicious transactions in time. The accusation comes while Kelp’s already fighting a separate $71 million court battle that’s been grinding through the system for months now. Two major financial hits in one stretch. Not great.

Kelp Ditches LayerZero Infrastructure

So Kelp’s done with LayerZero. The platform announced it’s switching to Chainlink for its oracle needs, and the move seems pretty urgent. Chainlink’s got a reputation for being harder to crack, which is probably what Kelp needs right now. The transition isn’t just about swapping one provider for another—it’s a complete overhaul of how Kelp validates cross-chain data and secures user funds.

Cross-chain bridges have become a favorite target for hackers over the past couple years. Billions have vanished through exploits that took advantage of weak spots in how different blockchains talk to each other. Kelp’s situation fits that pattern. The platform said it’s implementing Chainlink’s decentralized oracle solutions to create what it calls “more robust defense mechanisms” against future attacks. Translation: they’re trying to make sure this doesn’t happen again.

But here’s the thing. LayerZero hasn’t said anything publicly about Kelp’s accusations. No statement, no rebuttal, nothing. That silence is making people nervous because it leaves a lot of questions hanging. Did LayerZero know about the vulnerability? Were other platforms at risk? Unclear.

Court Case Adds Financial Pressure

The $71 million legal battle adds another layer of mess to Kelp’s situation. The platform hasn’t shared much about what that case involves or when it might wrap up. Court filings aren’t public yet, and Kelp’s lawyers seem to be keeping things quiet. The timing couldn’t be worse—dealing with a massive hack while fighting a separate multi-million dollar lawsuit puts serious strain on any company’s resources.

Kelp told users the Chainlink transition is a “critical step” in its recovery plan. The platform’s trying to reassure people that their remaining funds are safe and that the new infrastructure will prevent similar exploits. Whether users buy that argument depends on how fast Kelp can actually implement the changes and prove they work.

The DeFi space has seen this pattern before. Platform gets hacked, platform promises better security, users wait to see if it’s real. Sometimes the platform comes back stronger. Sometimes it doesn’t come back at all.

See also: BlinkEx Launches Spot Trading Platform With Proactive Security Controls

Kelp said it’s reviewing “all operational protocols” to find other potential weak spots. That review probably should’ve happened before $292 million walked out the door, but better late than never. The platform’s focusing on what it calls “resilience and operational security,” which is corporate speak for “we’re trying not to get hacked again.”

Industry watchers are paying attention to how this plays out. If Kelp successfully transitions to Chainlink and avoids future exploits, other platforms might follow. If Kelp stumbles or gets hit again, it’ll reinforce doubts about whether cross-chain DeFi can ever be truly secure.

The Chainlink switch involves more than just plugging in new oracle services. Kelp’s got to rebuild parts of its smart contract infrastructure, test everything extensively, and migrate user assets without creating new vulnerabilities in the process. That’s a lot of moving parts, and each one is a potential failure point.

Kelp hasn’t given a timeline for when the Chainlink integration will be complete. “Coming soon” is about as specific as they’ve gotten. Users are stuck waiting and hoping their funds stay put while the platform rebuilds.

The $292 million loss ranks among the bigger DeFi hacks in recent memory, though it’s not the biggest. The crypto industry has lost more than $3 billion to bridge exploits and cross-chain attacks over the past few years. Kelp’s just the latest name on a growing list.

See also: Law Firm Fights to Keep $134M in ETH Tied to Kelp Hack Frozen

What happens with the court case could determine whether Kelp survives long-term. If the platform loses and has to pay out $71 million on top of the $292 million already gone, the math gets pretty ugly. Kelp didn’t say whether it has insurance or reserve funds to cover potential legal judgments.

For now, Kelp’s betting everything on Chainlink’s security and its ability to win back user trust. The platform said it’s “committed to ensuring the integrity of its services,” but words are cheap in DeFi. Users want to see actual results—no more hacks, no more missing money, no more excuses. Kelp’s got to deliver on that, and fast.

Hub: Chainlink price, news, and analysis