LayerZero vs Chainlink CCIP: Security for Token Issuers

By the Guardian team Updated November 2026 6 min read

Quick answer. Neither is more secure for every token. LayerZero is as strong as the DVN set you pin per route. CCIP rests on Chainlink's 16-operator committee and governance, plus verifiers you add. Rate limits and keys matter as much.

Watch: LayerZero vs Chainlink CCIP: Security for Token Issuers 1:51

Video transcript

Is LayerZero or Chainlink CCIP more secure for your token? Neither, for every token. Verifiers, rate limits and keys decide it.

A disclosure: LayerZero is a Guardian client. We audit its code, and hold both protocols to one standard.

In April 2026, a forged message on a single-verifier LayerZero route released 116,500 rsETH from Kelp DAO. LayerZero says Kelp chose that setup. Kelp says it followed documented defaults.

LayerZero issuers pick their verifiers, called DVNs, per route, and can leave LayerZero Labs out. Every CCIP lane includes Chainlink's 16-operator committee plus verifiers you add.

Each has its own trap. On LayerZero, single-DVN routes and unpinned settings that inherit changeable defaults. On CCIP, a pool's verifier list that can replace the lane defaults.

Neither protocol enforces a rate limit until you set one. Set limits on both sides of every route, and put admin roles on a multisig.

Kraken is moving its wrapped assets to CCIP, and Kelp moved rsETH on three networks, while USDT0 runs on LayerZero. We found no published CCIP exploit post-mortem, but its new verifier design has a short record.

LayerZero suits issuers who want to own the verifier set and check every route after every change. CCIP suits those who want Chainlink's operators and governance as a floor.

A Guardian system review maps what you run and who holds the keys. Read the full article, or book one at guardian.security.

Disclosure: LayerZero is a Guardian client. Guardian audits LayerZero's code and verifies USDT0's LayerZero deployments. We hold both protocols to the same standard, citing each one's own documentation and reports.

In April 2026, a forged message on a single-verifier LayerZero route released 116,500 rsETH from Kelp DAO's bridge. Kraken and Kelp have since announced moves to Chainlink CCIP.

Below is what each depends on, what the issuer controls, and where each can fail, per both protocols' docs in November 2026.

How Each Verifies Messages

LayerZero: the DVNs you pin

Every LayerZero route has a security stack: required DVNs, optional DVNs and a threshold. A message is accepted once every required DVN, plus the optional threshold, attests.

The application picks the DVNs for each chain and direction. Unset sides fall back to presets that pair LayerZero Labs with Google Cloud or Polyhedra, or include a Dead DVN that blocks delivery.

LayerZero's docs warn that a 1-of-1 stack lets one operator forge or suppress messages, through its keys, RPC nodes or people.

CCIP: a committee, plus verifiers you add

Every CCIP 2.0 lane includes Chainlink's Committee Verifier: 16 independent node operators, of whom Chainlink says at least 9 must sign.

Since CCIP 2.0 went live on September 28, 2026, issuers can require extra Cross-Chain Verifiers (CCVs), their own or a third party's. Each must attest.

Chainlink advises keeping the committee: extra CCVs are "defense in depth on top of it, not a replacement."

Chainlink's Risk Management Network has also changed: its automated offchain role "is no longer active in current CCIP deployments."

An onchain RMN contract remains: a curse on a chain halts CCIP flows involving it until its owner lifts it.

A LayerZero issuer picks the whole verifier set, and can leave LayerZero Labs out. A CCIP issuer builds on Chainlink's committee.

What the Issuer Configures

In both, the issuer owns these settings:

Setting	LayerZero	CCIP
Verifiers	Required and optional DVNs, and a threshold	Committee, plus CCVs by lane, direction or amount
Finality	Block confirmations, pinned on both sides	Full finality unless the issuer opts into faster
Counterparts	Peers, set by the owner	Remote pools, set by the pool owner
Execution	One per route, LayerZero Labs by default; anyone can execute	Chainlink executor by default; anyone can execute

LayerZero roles

Owner: peers, enforced options and the delegate.
Delegate: DVNs, executor, confirmations, libraries and message recovery.

A compromised delegate "can re-route messages through their own DVN/library stack while the owner address remains untouched," LayerZero warns.

Pin every setting on both sides. An implicit side inherits defaults, and "LayerZero Labs can change that default at any time without notice."

CCIP roles

Token administrator: picks the token's pool, or delists the token.
Pool owner: lanes, limits, finality and admin roles.
Rate limit admin: limits only.
Hooks owner: allowlist, extra CCVs and any policy engine.

A pool's base CCV list replaces the lane defaults for token-only transfers, unless it includes address(0).

Our admin keys census found Re's reUSD CCIP pool, a minter, owned directly by a 3-of-5 Safe outside Re's timelock.

Rate Limits and Pause Controls

A rate limit caps what one forged message can release. Neither protocol enforces one until the issuer sets it.

LayerZero

Add a RateLimiter to your OFT, per destination. LayerZero says it guards against attempts "to rapidly drain tokens from a chain."
The Stablecoin OFT adds inbound and outbound limits, a pause per destination and a token-wide pause.
Its token pause splits pauser and unpauser, so "a compromised pauser key cannot also undo a legitimate security pause."

CCIP

Every pool supports outbound and inbound limits per lane. "It is highly recommended to set rate limits," Chainlink says.
Set inbound limits 5% to 10% above outbound, since chains finalize in batches.
To contain a lane, throttle both directions on both chains to zero, or remove the lane.
Those actions "do not pause CCIP globally." CCIP's own RMN curse can halt a whole chain.

Size limits to each route's normal flow, not to supply. Overly permissive limits "reduce their effectiveness as a safety mechanism," Chainlink notes.

Who Can Change the Protocol

LayerZero: endpoints are immutable. LayerZero Labs can move defaults, and only unpinned settings follow.
CCIP: the Router's code is immutable, but the ramps behind it can be swapped.
Changes to CCIP's contracts pass a timelock, proposed by a multisig of node operators and Chainlink Labs. Node operators can veto, or a signer quorum can approve urgent fixes.

So in LayerZero, most change runs through your settings and the operators you pick. In CCIP, more runs through CCIP's timelocked governance, visible onchain.

Incident and Operational History

On April 18, poisoned RPC nodes fooled LayerZero Labs' DVN, the only verifier on one Kelp route.

LayerZero says this released 116,500 rsETH, about $292 million, and found "no protocol-level failure." It says the application owner had changed a 2-of-2 stack to 1-of-1.

Kelp told CoinDesk its setup "followed LayerZero's documented defaults," crypto.news reported. Our Kelp DAO breakdown sets out both accounts.

LayerZero Labs' DVN now refuses to be a route's only required DVN. A 1-of-1 with another DVN is still possible, and "the protocol will enforce that policy."

Big issuers sit on both sides:

Kraken said on May 14 it is deprecating its existing cross-chain provider for CCIP, for kBTC and future wrapped assets.
Kelp moved rsETH on Base, Mantle and Ink to CCIP on October 5.
USDT0, Tether's omnichain USDT, runs on LayerZero's OFT standard across more than 25 chains.

We found no published post-mortem of a CCIP exploit. CCIP 2.0's verifier design went live only in September 2026, so its record under that design is short.

Decision Table

Question	LayerZero	CCIP
Who verifies if you change nothing?	LayerZero's default stack, which can change	Chainlink's 16-operator committee
Can you verify without the provider?	Yes: choose DVNs without LayerZero Labs	Not advised: CCVs add to the committee
Can an institution run its own verifier?	Yes, as a required DVN	Yes, as a custom CCV
Who can halt a lane?	Your pause roles	Your limit roles, and CCIP's RMN curse
Who changes core contracts?	Endpoints are immutable; LayerZero Labs sets defaults	CCIP governance, timelocked, with operator veto
Main thing to get wrong	Unpinned or single-DVN routes	CCV lists that drop the lane defaults

LayerZero fits issuers who want to own the verifier set, and can check every route after every change.

CCIP fits issuers who want a provider-run floor, and accept dependence on Chainlink's operators and governance.

Either way, put every admin role on a multisig, set limits on both sides of every route, and alert on every change.

Our stablecoin security guide covers the controls around the bridge.

How Guardian Helps

Guardian has run twenty LayerZero engagements across five execution environments, per our LayerZero client story.

Since February 2025, Guardian has verified USDT0's peers, DVN sets, confirmations and enforced gas on every pathway, across 25+ chains. The method is in our deployment verification and OFT checklists.

On either protocol, a system review call maps what you run and who holds the keys. Managed Security then reviews every multisig transaction before it is signed.

Frequently Asked Questions

CCIP vs LayerZero: which is more secure?

Neither is more secure for every token. LayerZero depends on the DVNs you pin per route. CCIP depends on Chainlink's committee and governance, plus verifiers you add. Limits and keys matter in both.

What is the difference between a DVN and a DON?

A DVN is any verifier an application names in its LayerZero security stack. A DON is a Chainlink oracle network. CCIP's default Committee Verifier is a DON of 16 node operators, and Chainlink says at least 9 must sign.

Does CCIP still use the Risk Management Network?

Not as an automated offchain verifier: Chainlink's docs say that role is no longer active. The onchain RMN contract remains as an emergency stop that halts CCIP flows on a cursed chain.

Can a token issuer run its own verifier?

Yes, on both. A LayerZero issuer can run its own DVN and make it required. A CCIP 2.0 issuer can deploy a custom Cross-Chain Verifier, which Chainlink advises adding on top of the default committee.

Sources

Check every route before it carries value

Guardian maps your verifiers, rate limits and admin keys on LayerZero or CCIP, then reviews every multisig transaction before it is signed.

Talk to Guardian Book a system review