05/20/2026
Your vendor's certifications didn't protect Kelp.
Security certifications tell you what a system passed. They don't tell you what it assumes.
LayerZero had documentation, adoption, and integrations across major protocols. None of that mattered when a single verifier stood between $292 million and the Lazarus Group.
Kraken just dropped LayerZero as their cross-chain infrastructure for wrapped Bitcoin. They're moving exclusively to Chainlink CCIP.
The breach: April 2026 at Kelp DAO. Attackers drained $300 million. The weakness? A single-verifier setup.
One point of failure. One incredibly expensive assumption.
The market is responding: Over $3 billion in total value locked is migrating away from LayerZero. Widespread adoption doesn't equal operational security.
4 questions to evaluate vendors after catastrophic failures:
1. What happens to your operations if the primary validation mechanism goes offline today?
2. How many independent entities must be compromised for a breach to happen?
3. Are security limits hardcoded or can a single admin alter them?
4. What specific assumptions is your vendor making about your network environment?
Why Kraken switched: 16 independent node operators validating every transaction. Decentralized risk management works when you build it into the architecture from day one.
Your infrastructure is either a structural advantage or a liability waiting for the right trigger.
How do you evaluate vendors? Architecture or marketing deck?
Like and comment if you're rethinking how you vet infrastructure partners.