Chainlink recorded 282,170 active addresses on May 9 and 264,090 the following day, marking the strongest sustained network activity since September 2025 according to on-chain analytics firm Santiment. The surge traces directly to the aftermath of the $292 million Kelp DAO exploit on April 18, when attackers drained roughly 116,500 rsETH from infrastructure tied to LayerZero's cross-chain bridge, triggering industry-wide security reviews and a wave of protocol migrations toward Chainlink's Cross-Chain Interoperability Protocol.

Kelp DAO announced plans to migrate to CCIP following the exploit, and on May 7 Solv Protocol confirmed it would move more than $700 million in tokenized Bitcoin to the same infrastructure. Santiment noted that these moves represent a major shift of institutional-scale DeFi activity away from LayerZero and toward Chainlink's ecosystem, and that the resulting spike reflects genuine protocol usage rather than speculative trading — a distinction the firm considers significant because historically, real network usage spikes have preceded sustained price appreciation rather than short-lived pumps.