Wyoming’s Stable Token Commission has completed its migration of the Frontier Stable Token (FRNT) away from LayerZero and onto Chainlink’s Cross-Chain Interoperability Protocol (CCIP), following a security review triggered by the April 18, 2026 KelpDAO bridge exploit. The commission’s chief information security officer, Keith Lawhorn, said the state owes FRNT holders a duty of care because the token is the first dollar-backed digital asset issued by a U.S. state and is treated as a public good.
The review was launched after attackers affiliated with North Korea breached off-chain infrastructure operated by LayerZero Labs. According to LayerZero’s own incident report cited by Lawhorn, a verifier monitoring Unichain accepted a fabricated event, causing Ethereum to release funds even though the corresponding Unichain action never happened. The resulting loss was approximately $292 million.
Lawhorn said the examination found that FRNT faced comparable operational and architectural risks. He described a pattern of failures at LayerZero Labs, including a production authorization transfer issue and inadequate control of a private key used for a live FRNT deployment. The commission also cited insufficient disclosure of incidents and said many LayerZero deployments rely on a single verifier or a very small set, which is unacceptable for a public financial system.
Wyoming compared LayerZero, CCIP and other alternatives across six dimensions and selected CCIP for eight networks: Arbitrum, Avalanche, Base, Ethereum, Hedera, Optimism, Polygon and Solana. The commission said CCIP uses 16 independent, security-reviewed node operators on every supported chain, with an OCR consensus process followed by a separate signing stage. It also cited SOC 2 Type 2 certification reviewed by a Big Four firm, about 50 security audits, and Chainlink’s record of staying online during the COVID crash, the FTX collapse, network congestion and the October 2025 AWS outage.
Lawhorn added that Chainlink’s Cross-Chain Token standard lets Wyoming control its contracts, token pools, policies and implementation logic, while adjustable rate limits act as circuit breakers for each token, lane and transfer direction. The commission has retired the LayerZero and Stargate route and said the September 14 memo can serve as a template for other governments moving regulated assets across chains.
LayerZero co-founder and CEO Bryan Pellegrino pushed back on the lost-key characterization. He said LayerZero deployed FRNT on Solana with every Token-2022 extension initialized as requested, and that the disputed Scaled UI Amount authority was view-only metadata that cannot mint, burn, freeze, seize, pause, transfer funds or alter supply. Pellegrino said the authority was transferred within 24 hours after the commission flagged it, and that he continues to support Executive Director Anthony Apollo and the commission’s work.
Following the news, LayerZero’s ZRO token traded at $0.98, down about $0.0389, or 3.82%, over 24 hours, with a market capitalization of $347 million. The intraday chart showed an early rise followed by fading momentum and lower highs, with ZRO finishing near the session low as selling continued into the close.
