LayerZero, a cross-chain interoperability protocol, saw its native token ZRO undergo a sharp price correction in April 2026. As of April 22, 2026, Gate market data shows ZRO trading at $1.61, with a 17.82% drop over the past seven days, an 18.86% decline over the past 30 days, and a 35.61% decrease year-over-year. Meanwhile, its market capitalization has fallen to $405 million, with a fully diluted market cap of about $1.6 billion and a current circulating rate of only around 25.23%.
The immediate trigger for this downturn was the KelpDAO rsETH cross-chain bridge attack. On the evening of April 18, attackers forged a cross-chain message and stole 116,500 rsETH, worth roughly $294 million, from KelpDAO’s bridge contract. ZRO dropped from around $2 before the incident to as low as $1.4, with a single-day maximum decline exceeding 22%. Although the price recovered somewhat afterward, the fracture in market confidence is now unmistakable.
However, attributing ZRO’s decline solely to a security incident fails to capture the deeper shift in its pricing logic. The real core issue is that the market is systematically applying a security discount to "bridge tokens." This discount mechanism is shaped both by event-driven sentiment shocks and by structural risk reassessment.
The Technical Roots of a $294 Million Cross-Chain Attack
On April 18, 2026, at 17:35 UTC, a wallet that had been laundered through Tornado Cash sent a cross-chain message to LayerZero’s EndpointV2 contract, claiming a user on a certain chain wanted to bridge rsETH back to Ethereum mainnet. LayerZero’s decentralized validator network (DVN) verified the message, and KelpDAO’s bridge contract on mainnet released 116,500 rsETH to an address controlled by the attacker.
The issue was that no corresponding rsETH deposit ever occurred on the supposed "source chain." The attacker poisoned the downstream RPC infrastructure relied on by the DVN, used DDoS attacks to force the system to switch to malicious nodes, and successfully forged a cross-chain transaction validation. Forty-six minutes later, KelpDAO’s emergency multisig paused the contract, but by then the attacker had already deposited the stolen rsETH into Aave V3 as collateral and borrowed approximately $236 million worth of wETH.
On the technical side, KelpDAO’s bridge contract used a 1/1 DVN configuration—meaning it relied on a single validator to confirm cross-chain messages. This setup shrinks the security boundary of the entire cross-chain validation process to a single point. If the underlying infrastructure supporting that validator is compromised, the entire validation chain is exposed. In fact, a subsequent Dune Analytics report showed that out of 2,665 OApp contracts built on LayerZero, as many as 47%—covering 1,252 projects—used the same 1/1 DVN setup. This means the security vulnerability exposed by the KelpDAO incident is not an isolated case, but a widespread risk across the ecosystem.
From Event Shock to Systematic Discounting
ZRO’s price action clearly illustrates how the market prices in security incidents. After the event, ZRO plunged from $2 to $1.4, a 18.15% drop within 24 hours. During the same period, AAVE fell 17.03%, LDO dropped 13.11%, and KERNEL declined 11.26%. The entire Liquid Restaking Token sector and related DeFi protocol tokens suffered varying degrees of impact.
This downturn unfolded through two mechanisms. The first was direct liquidity shock: during ZRO’s price collapse, a whale holding a long ZRO position on Hyperliquid was partially liquidated, realizing losses of about $2.88 million and an unrealized loss exceeding $750,000. The Polymarket address "greenrooibos" also transferred about 978,000 ZRO (roughly $1.57 million) to exchanges in a short period, incurring an unrealized loss of about $470,000 compared to two weeks earlier. Forced liquidations of leveraged positions and stop-loss exits by large holders reinforced downward price pressure.
The second mechanism was structural price correction across related assets. As a liquid staking token, rsETH is widely integrated into lending protocols and yield strategies like Aave, SparkLend, and Fluid, forming a deeply interconnected DeFi asset network. When the security of the rsETH cross-chain bridge was compromised, other protocols relying on LayerZero infrastructure quickly took defensive actions—over 15 protocols preemptively suspended LayerZero OFT cross-chain bridge functionality, including Ethena, TRON DAO, ApeChain, ether.fi, Solv Protocol, and others. Curve Finance also paused its LayerZero-based CRV cross-chain bridge and crvUSD fast bridge.
This "contagion effect" reveals a reality the market had not fully priced in before: when a foundational cross-chain protocol is deeply embedded in the DeFi ecosystem, its security incidents don’t just impact a single application—they propagate through the asset network layer by layer, ultimately manifesting as systematic discounting in the protocol’s native token price.
Redefining Bridge Tokens: From "Protocol Governance" to "Infrastructure Insurance"
Before the KelpDAO incident, the market’s valuation framework for ZRO centered on LayerZero’s cross-chain network effects and institutional narratives. LayerZero had integrated over 165 chains, with cumulative cross-chain volume exceeding $225 billion and more than 159 million messages processed. Since March 2026, 100% of Stargate’s revenue has flowed into ZRO buybacks, marking the first time protocol cash flow directly returned to token holders. The integration of Canton Network was seen as a catalyst to unlock the $8 trillion RWA market.
These narratives collectively built a valuation framework focused on "network adoption + future cash flow." However, the KelpDAO incident shattered the internal assumptions of this model. When LayerZero’s infrastructure proved vulnerable to real-world attacks, "network adoption" became a risk amplifier—the more applications, the broader the potential impact of a single point of failure. The expectation of "future cash flow" was also eroded by reputational damage from the security event, as multiple protocols’ preemptive suspensions meant reduced cross-chain volume in the short term, affecting Stargate’s revenue and ZRO buyback scale.
The pricing logic for bridge tokens is undergoing a paradigm shift. Previously, the market tended to view cross-chain protocol tokens as "economic certificates for protocol governance and network usage," with their value anchored to protocol adoption and network effects. But repeated security incidents are forcing the market to redefine this asset class—bridge token value now depends not only on protocol adoption, but also on the protocol’s ability to absorb shocks, control contagion, and restore confidence during security events.
In other words, the market is now applying a previously overlooked pricing factor to bridge tokens: infrastructure risk premium. The size of this premium depends on a protocol’s flexibility in security configuration, speed of incident response, transparency in responsibility allocation, and ability to restore ecosystem health. In the KelpDAO incident, ZRO’s decline far exceeded other DeFi tokens during the same period, reflecting the market’s rapid pricing of this new risk factor.
Industry Perspective: Systemic Vulnerabilities in Cross-Chain Infrastructure
Zooming out to the industry level, the KelpDAO attack is not an isolated cross-chain bridge security incident. In recent years, cross-chain bridges have become one of the most frequent attack targets in crypto. The fundamental reason is that bridges serve as gateways for value flow between blockchains, naturally concentrating high-value assets. At the same time, bridge security models involve multiple components—source chain, target chain, validator network, RPC nodes—and any vulnerability in these layers can be exploited by attackers.
LayerZero’s modular security design—which allows applications to customize DVN configurations—is theoretically a flexible architecture. But in practice, it has led to uneven security standards. The fact that 47% of OApps use a 1/1 DVN setup indicates most developers opt for the "default path" rather than the "optimal path" in security configuration, partly because multi-DVN setups entail higher operational costs and more complex deployment.
This "default insecurity" reflects a fundamental imbalance in priorities during the market expansion phase of cross-chain protocols. In the early stages, integrating more chains and attracting more applications often takes precedence over enforcing the highest security standards. The KelpDAO incident, costing $294 million, has put a real market price tag on this strategic choice.
For the entire cross-chain interoperability sector, the long-term impacts of this event may include: accelerated standardization of security configurations, migration from single-validator to multi-validator DVN models, reevaluation of insurance protocol coverage for bridge tokens, and a systematic increase in user awareness of cross-chain asset risks.
Conclusion
The KelpDAO incident brought the market not only a $294 million asset loss and a 22% single-day plunge in ZRO, but also a collective rethink of risk pricing in cross-chain infrastructure. When the value of bridge tokens depends not just on how many chains they connect or how much transaction volume they process, but also on their resilience and sense of responsibility in security events, the entire sector’s valuation logic is set for a profound overhaul.
For LayerZero, the core challenge at this stage isn’t fixing code—it’s rebuilding trust. For the market, whether the systematic discounting of bridge tokens is a short-term event-driven mispricing or a structural downward shift in long-term valuation will become clear in the coming months, as progress in security migration, cross-chain volume data, and ecosystem recovery unfolds.
As of April 22, 2026, Gate market data shows ZRO trading at $1.61, with 24-hour trading volume of $1.04 million and a market cap of $405 million. The market is still waiting for the next card to be revealed.
