The Kelp DAO exploit triggered DeFi oracle provider migrations. Solv Protocol and others are moving to Chainlink infrastructure after the $293 million breach exposed cross-chain security gaps. The shifts follow an April attack that drained 116,500 rsETH tokens from Kelp DAO, prompting protocols to reassess third-party oracle and bridge setups.
Solv Protocol announced Thursday it would migrate to Chainlink’s Cross-Chain Interoperability Protocol, replacing LayerZero bridges. The Bitcoin DeFi platform cited an internal security review that concluded CCIP provided stronger security assurances. A day earlier, liquidity protocol Tydro moved to Chainlink after its previous oracle provider, Chaos Labs, suffered an incident that forced Tydro to pause markets over inaccurate price feeds.
Kelp DAO exploit triggers provider rethink
Kelp DAO itself migrated its rsETH token to Chainlink infrastructure following the April 18 breach. The protocol had relied on a LayerZero-powered bridge. Kelp attributed the incident to weaknesses in its cross-chain configuration.
LayerZero countered on April 20 that the exploit resulted from a single point of failure in Kelp DAO’s implementation. The protocol had relied on a single LayerZero DVN as the only verified path, a setup LayerZero had warned against.
| Event | Date | Action | Provider |
|---|---|---|---|
| Kelp DAO exploit | 18 April | 116,500 rsETH drained | LayerZero bridge |
| Tydro incident | Prior week | Markets paused | Chaos Labs |
| Solv migration | This week | Switched to CCIP | Chainlink |
| Kelp migration | Post-exploit | Moved rsETH token | Chainlink |
Zach Rynes, strategic initiatives lead at Chainlink Labs, called the Kelp DAO exploit a wake-up call. DeFi teams conducting security reviews are replacing older oracle and bridge systems with Chainlink infrastructure to strengthen baseline protections, he said. Multiple other protocols are discussing potential Chainlink migrations following the exploit.
Track record becomes the filter
Marcin Kazmierczak, co-founder of RedStone, the fourth-largest blockchain oracle provider, said oracle providers with long operating histories and strong reliability are becoming more important as hacks continue. RedStone maintains a fully reliable track record, he said. The firm provided emergency support to Tydro after the Chaos Labs incident, helping restore oracle feeds for the protocol.
Only a smaller group of specialised providers may be able to meet the demand and reliability requirements created by growing institutional participation in DeFi, Kazmierczak said. A smaller set of trusted oracles is forming in the market. As capital concentrates around providers with proven track records, the risk of oracle-related exploits could decline, he added.
Chainlink remains the largest oracle provider with a 58% market share and more than $32 billion in value secured, according to DefiLlama. Chronicle ranks second with $7.6 billion in total value secured. RedStone holds fourth place with $3.7 billion, representing a 6.7% market share.
Concentration risk question
Nik Kunkel, founder of Chronicle, the second-largest oracle provider, said an overreliance on a single infrastructure provider will always present additional risks. There are risks anytime a large portion of an ecosystem depends on a single piece of infrastructure, he said. Reducing those risks also requires data infrastructure to remain independently transparent and verifiable.
Rynes said Chainlink’s infrastructure was designed to withstand extreme market conditions. He pointed to the 2020 Covid market crash, the 2022 FTX collapse, and major volatility events in 2025. Chainlink continued operating throughout those disruptions, he said.
The Kelp DAO exploit sits in the upper tier of DeFi breaches by size. The $293 million figure ranks among the sector’s largest single incidents. Whether the migration wave proves temporary or marks a structural shift depends on how the next few quarters print. Two exploits attributed to oracle weaknesses in quick succession is a pattern. Three would be a trend.
This article is for information purposes only and does not constitute investment advice. Readers should not act on any information contained here without first consulting an authorised financial adviser. Past performance is not a reliable indicator of future results.
