Key Takeaways
- Kelp DAO successfully burned 117,132 rsETH tokens belonging to the attacker on the Arbitrum blockchain
- Recovery operations will replenish stolen rsETH over a two-week period through Aave Recovery Guardian and Kelp Recovery Safe mechanisms
- Withdrawal functionality is scheduled to resume within 24 hours following the initial refill deployment
- Enhanced security protocols now mandate four separate attestors alongside 64 block confirmations
- Federal court authorized Arbitrum’s transfer of $72 million in recovered ETH to Aave, though restrictions on fund movement remain in place
Kelp DAO and Aave have commenced restoration procedures after the April 18 security breach that resulted in approximately $292 million being extracted from Kelp’s rsETH bridge infrastructure. The incident stands as 2026’s most significant decentralized finance security compromise.
Security analysts broadly linked the assault to North Korea’s notorious Lazarus Group. The attackers exploited vulnerabilities in Kelp’s LayerZero bridge adapter, the component responsible for minting, securing, and distributing rsETH across multiple blockchain ecosystems.
Following the breach, the perpetrator transferred substantial quantities of the compromised rsETH to Aave, utilizing it as collateral to secure wrapped Ether loans. This action resulted in approximately $190 million in uncollectible debt for Aave.
In reaction to the crisis, Aave spearheaded a collective recovery campaign named DeFi United. This collaborative effort successfully accumulated over $300 million in ETH to address losses and mitigate broader repercussions throughout the DeFi ecosystem.
On Tuesday, representatives from both Kelp and Aave announced completion of the recovery plan’s initial phase. The attacker’s 117,132 rsETH tokens — presently valued at approximately $278 million — have been permanently removed from circulation on Arbitrum.
Normal Withdrawal Functions Set to Return Imminently
Kelp announced plans to reinstate withdrawal capabilities provisionally within 24 hours after the initial allocation reaches the LayerZero OFT adapter smart contract. Complete operational restoration, encompassing deposits, redemptions, cross-chain bridging, and claim processing, will subsequently follow.
The compromised funds will be systematically replenished throughout a two-week timeline utilizing resources from the Aave Recovery Guardian mechanism and Kelp’s dedicated recovery repository.
Kelp has additionally implemented comprehensive security enhancements to its bridging infrastructure. The verification process now mandates four independent attestors, replacing the earlier single-attestor framework. Block confirmation requirements increased from 42 to 64, while all layer-2 to layer-2 routing pathways have been discontinued.
The protocol is additionally transitioning from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol for future cross-chain transaction management.
LayerZero Issues Statement Accepting Responsibility
LayerZero has released a formal apology acknowledging its contribution to the security vulnerability. The organization initially attributed responsibility to Kelp for implementing a 1-of-1 DVN configuration, claiming this contradicted their guidance. Kelp responded by noting this configuration represented the standard setting across LayerZero-enabled applications.
LayerZero subsequently recognized its error in permitting such configurations for substantial-value transactions.
Concurrently, the Arbitrum Security Council immobilized approximately $72 million in attacker-controlled ETH on Arbitrum. The Arbitrum DAO granted authorization for transferring these assets to the compensation initiative.
This transfer encountered legal complications in early May when plaintiffs holding previous terrorism-related judgments against North Korea secured a court directive preventing the transaction.
Aave LLC filed an urgent motion in federal court, contending the restraining order relied on unsubstantiated assumptions.
The court ruled favorably for Aave, permitting Arbitrum to execute the ETH transfer. Nevertheless, Aave continues facing restrictions on selling or relocating the funds pending additional judicial authorization.
Kelp’s total value locked registered at approximately $1.55 billion this week, declining from an all-time peak exceeding $2 billion in September 2025.
Ether traded near $2,260 on Tuesday, reaching a 12-day minimum, declining approximately 1% during the trading session.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
