Kelp DAO hacker laundered $220 million, recovery hopes dim

The hacker behind Kelp DAO’s $293 million exploit has moved roughly $220 million of stolen funds, casting doubt on the protocol’s five‑week recovery plan and deepening concerns over DeFi security [1].

Hacker activity and Kelp DAO’s stalled recovery

Arkham data shows the attacker’s wallet now holds about $220 million of the original $293 million exploit, indicating that most of the loot has already been moved off‑chain [1]. Kelp DAO had announced a five‑week plan to restore its restaked Ether token (rsETH) by burning the attacker’s tokens and refilling the supply from an Aave “Recovery Guardian” multisig wallet. The burn of 117,132 rsETH—worth roughly $278 million at current prices—was confirmed, but the first tranche of restored tokens has yet to be returned to the smart contract, leaving withdrawals paused and the protocol’s market cap of $1.5 billion still fully backed only on paper [4].

Ripple effects across DeFi

The hack forced Aave to write off about $195 million in bad debt after the attacker used the stolen rsETH as collateral to borrow wrapped Ether, pushing Aave’s total value locked (TVL) down by more than $8 billion, from $23.5 billion in March to about $14.8 billion now [2]. Although Ether utilization has slipped below 90 % and borrowing rates fell to 1.9 %—potentially attracting new leveraged strategies—deposit volumes for wstETH and weETH remain down $1.2 b and $1.76 b respectively, indicating lingering risk aversion [2].

Security upgrades and network changes

In response to the exploit, Kelp DAO migrated its rsETH bridge to Chainlink’s Cross‑Chain Interoperability Protocol (CCIP) and is deprecating several layer‑2 routes, adding four independent attestors and 64 block confirmations for future bridges [4]. The protocol also announced it will sunset rsETH bridging on Optimism, HyperEVM, Unichain, Avalanche and MegaETH after June 15, consolidating to networks deemed most secure [2].

What to watch

• rsETH restoration milestones – monitor whether the first tranche of 117,132 rsETH is returned to the contract within the next two weeks.
• Aave TVL trajectory – watch for any rebound above $15 b, which would suggest liquidity is returning to the market.
• Chainlink CCIP integration – track the performance of the new bridge, especially any incidents on the four‑attestor, 64‑confirmation setup.

The laundered $220 million underscores how quickly stolen DeFi assets can be obscured, while Kelp DAO’s delayed token restoration highlights the challenges of coordinating multi‑protocol recoveries in a fragmented ecosystem.