TLDR
- Five weeks following the April 2026 exploit by North Korea’s Lazarus Group that drained $293 million, Kelp DAO has finalized the operational recovery of its rsETH token.
- A concluding batch of 20,373.72 rsETH was deposited into the LayerZero OFT adapter, bringing cross-chain bridge collateralization back to full capacity.
- According to the platform’s real-time monitoring system, rsETH now maintains a 100.01% ETH backing ratio, confirming complete collateralization.
- Aave, significantly impacted by the incident, contributed funding to the recovery effort, though its total value locked remains at approximately $14 billion—roughly half its pre-hack $26.4 billion level.
- Standard minting, withdrawal, and staking reward functions resumed normal operations following the May 14 reopening of redemptions.
Ethereum-based liquid staking platform Kelp DAO has announced the completion of its operational recovery process for restaked Ether tokens, occurring five weeks following a major security breach attributed to the North Korean state-sponsored Lazarus Group that resulted in $293 million in losses.
On May 25, the platform completed the transfer of its final allocation—20,373.72 rsETH—into the LayerZero OFT adapter responsible for facilitating token transfers and maintaining liquidity across various blockchain networks.
This concluding transfer marked the end of an extensive replenishment campaign spanning two weeks, during which roughly 116,000 rsETH was restored to the adapter through collaborative support from Aave alongside other protocols participating in the DeFi United recovery coalition.
Kelp’s publicly accessible monitoring dashboard currently displays a 100.01% ETH collateralization ratio with complete bridge reserves secured across both LayerZero and Chainlink network infrastructure.
According to the protocol’s announcement, all standard operations including token minting, user redemptions, and staking reward distribution have functioned without interruption since the May 14 withdrawal reopening.
Details of the April Security Breach
The Lazarus Group successfully compromised Kelp DAO’s infrastructure on April 18, extracting 116,500 rsETH tokens valued at approximately $293 million during the incident.
Following the theft, the attackers deposited a substantial portion of the stolen rsETH as loan collateral on Aave‘s decentralized lending platform, subsequently borrowing wrapped Ether against it. This strategy left Aave holding $190 million in uncollectible debt and sparked widespread user panic leading to mass fund withdrawals.
The cascading effect caused Aave’s total value locked to plummet from $26.4 billion down below $14 billion, stripping away its ranking as the DeFi sector’s largest protocol by TVL.
This Kelp DAO security breach represented one incident among 25 separate cryptocurrency hacks documented throughout April. Aggregate losses for that month totaled $630 million, establishing it as the most devastating period since Bybit’s $1.5 billion exploit in February 2025.
Aave’s Ongoing Recovery Challenges
While net capital outflows from Aave’s lending ecosystem have moderated during the previous month based on DefiLlama analytics, the platform’s total value locked has failed to demonstrate meaningful recovery.
Aave’s TVL has remained stagnant, fluctuating within a narrow $13.9 billion to $15.1 billion range since approximately one week following the security incident.
The initial rsETH batch of 25,000 tokens was transferred on May 13, enabling the restoration of bridging capabilities between Ethereum’s primary network and various layer 2 scaling solutions.
Kelp has declared the operational recovery phase officially concluded. However, the more substantial task of restoring user trust and market confidence continues.
Recent months have heightened investor scrutiny regarding cross-chain bridge security protocols, collateral transparency standards, and financial solvency verification across restaking service providers.
Platforms throughout the sector have responded by dedicating increased resources toward implementing real-time reserve monitoring dashboards, cryptographic proof-of-reserve mechanisms, and publicly auditable recovery wallet tracking systems.
KelpDAO has directed community members to examine its live transparency dashboard as verification that system operations have normalized and that rsETH maintains full backing by underlying assets.


