Kelp DAO restores rsETH functionality five weeks after $293M hack

Kelp DAO announced that it has finished the operational phase of its rsETH recovery plan, restoring full token functionality more than five weeks after a $293 million exploit tied to North Korea’s Lazarus Group [2]. The protocol transferred the last tranche of 20,373.7 rsETH to the LayerZero contract that manages cross‑chain token operations, marking the final step needed to re‑back the token after the April 18 breach.

Key takeaways

• Kelp DAO moved the final 20,373.7 rsETH to LayerZero, completing its recovery plan [2].
• The original exploit drained 116,500 rsETH from Kelp’s bridge, causing $293 million in losses [2].
• Aave’s markets still carry roughly $190 million in bad debt from the attack, though borrowing activity has begun to resume [2].
• Legal disputes over frozen ETH (about 30,765 ETH, ~ $71 million) remain unresolved, with competing claims involving families of terrorism victims and Aave [2].
• Kelp DAO plans to migrate its bridge from LayerZero’s OFT framework to Chainlink’s cross‑chain protocol to improve security [2].

Recovery milestones and ongoing fallout

Kelp DAO’s latest update, posted on X, confirmed that the final batch of rsETH was sent to the LayerZero smart contract responsible for token locking, minting, burning and release across chains. This move follows an earlier transfer of 25,000 rsETH on May 13 that allowed withdrawals and bridging to resume. With minting, redemption and reward functions now operating normally, the protocol says rsETH is fully backed again [2].

The exploit, which occurred on April 18, siphoned 116,500 rsETH from Kelp’s bridge infrastructure, translating to a $293 million loss. Attackers immediately used the stolen rsETH as collateral on Aave, borrowing wrapped Ether and leaving nearly $190 million in bad debt across Aave’s markets. Although Aave’s total value locked fell sharply—from over $26 billion to under $14 billion—recent governance actions have restored borrowing against wrapped Ether on several Aave V3 deployments [2].

Legal battles continue over the roughly 30,765 ETH that the Arbitrum Security Council froze on April 21. Families pursuing terrorism‑related judgments against North Korea argue the assets are tied to Lazarus Group activity, while Aave contends that no court has formally attributed the exploit to North Korean actors and that the frozen assets belong to affected users [2]. Additionally, Kelp DAO’s relationship with LayerZero remains strained; the protocol announced a migration to Chainlink’s Cross‑Chain Interoperability Protocol to bolster bridge security, a claim that LayerZero’s co‑founder Bryan Pellegrino has disputed [2].

Why it matters

The completion of Kelp DAO’s rsETH recovery demonstrates how coordinated DeFi initiatives can mitigate the damage from large‑scale exploits, but the episode also highlights persistent vulnerabilities in cross‑chain infrastructure. The ongoing legal disputes over frozen ETH underscore the challenges of attributing cyber‑theft to state‑linked actors and determining rightful ownership of recovered assets. As Kelp DAO transitions to a new bridge solution, the broader DeFi ecosystem will watch closely to see whether enhanced security measures can prevent similar attacks and restore confidence among users and lenders.