LayerZero Loses $2B in TVL to Chainlink CCIP After Lazarus Group Exploit Confession

TLDR: LayerZero admitted its internal RPC was attacked by the Lazarus Group, exposing a critical security gap. Three protocols managing a combined $2B in TVL have confirmed migrations to Chainlink CCIP after the exploit. A 1/1 DVN misconfiguration created a single point of failure that left LayerZero vulnerable to attack. Major assets like Ethena’s USDe, Etherfi’s weETH, and Bitgo’s WBTC still rely on LayerZero’s OFT standard. Multiple blockchain protocols are shifting away from LayerZero following a confirmed exploit and a public apology from the team. Analyst Tom Wan reports that protocols with a combined total value locked (TVL) of approximately $2 billion have announced migrations to Chainlink CCIP. KelpDAO leads the move with $1.5 billion, followed by SolvProtocol at $600 million and re at $200 million. The shift raises questions about LayerZero’s ability to retain clients. Major Protocols Move Combined $2B TVL to Chainlink CCIP The migration comes after LayerZero acknowledged serious security failures in a public statement. The team admitted that an internal RPC node was compromised by North Korea’s Lazarus Group. More critically, LayerZero confessed to a 1/1 DVN misconfiguration that left the protocol with a single point of failure. Tom Wan, a well-followed on-chain analyst, flagged the departures on X. He wrote that despite the apology, KelpDAO, SolvProtocol, and re had already announced moves to Chainlink CCIP. His post noted the combined TVL at risk and questioned whether an apology could stop further client losses. Finally an apology from Layerzero but multiple protocols with a combined TVL of ~$2B have already announced migrating to @chainlink CCIP • @KelpDAO: $1.5B• @SolvProtocol: $600M• @re: $200M Remaining top tokens that are still using OFT:• USDe/sUSDe by Ethena• weETH by… — Tom Wan (@tomwanhh) May 9, 2026 The decision by these three protocols reflects growing concern over cross-chain infrastructure reliability. When a misconfiguration at that le...