Kelp DAO Completes rsETH Recovery After $293M Exploit Linked to Lazarus Group

TLDR

• Kelp DAO completed the operational phase of its rsETH recovery plan.
• The recovery followed a $293M exploit linked to North Korea’s Lazarus Group.
• The final 20,373.72 rsETH tranche was sent to LayerZero’s OFT adapter.
• Kelp said rsETH minting, redemptions and rewards are running normally.
• Aave said rsETH and all Aave markets are now operating normally.

Kelp DAO has completed the operational phase of its rsETH recovery plan, five weeks after a $293 million exploit disrupted the protocol and affected several decentralized finance markets.

The Ethereum liquid staking protocol confirmed that the final tranche of 20,373.72 rsETH was sent to the LayerZero OFT adapter. The adapter is responsible for locking, minting, burning and releasing rsETH during cross-chain transfers.

The recovery followed an April 18 exploit linked in reports to North Korea’s Lazarus Group. The attack targeted Kelp DAO’s bridge infrastructure through a forged LayerZero packet, allowing attackers to move rsETH across chains and later use the token in lending markets.

Kelp DAO Restores rsETH Operations

Kelp DAO said rsETH minting, redemptions and rewards operations have been running normally since withdrawals were reopened earlier this month. The protocol added that rsETH has remained fully backed since the unpause.

Over the past two weeks, about 116,000 rsETH has been refilled into the rsETH OFT adapter by Aave and Kelp, according to the protocol’s update on X. Kelp said users can continue tracking the token’s backing through its public dashboard.

The first tranche of 25,000 rsETH was transferred on May 13, allowing rsETH bridging between Ethereum mainnet and Layer 2 networks to resume. Withdrawals were reopened on May 14.

The final transfer of more than 20,000 rsETH closes the main operational part of the recovery plan. Kelp said several crypto protocols helped restore backing through the DeFi United initiative.

Aave Markets Return to Normal

The Kelp DAO exploit affected the wider DeFi lending market because a large amount of stolen rsETH was deposited into Aave as collateral. The attacker then borrowed wrapped Ether against those assets, creating stress across Aave’s lending pools.

Reports from the incident estimated that about 116,500 stolen rsETH was used in the process. Aave was left with around $190 million in bad debt after the exploit, triggering withdrawals as users reduced exposure.

Aave’s total value locked dropped sharply during the crisis, falling from about $26.4 billion to below $14 billion. More recent on-chain data shows the platform has stabilized, with TVL fluctuating between roughly $13.9 billion and $15.1 billion.

Aave confirmed that the final rsETH tranche had been sent to the LayerZero lockbox and said rsETH and all Aave markets are now operating normally.

April Hack Adds to DeFi Security Concerns

The Kelp DAO exploit was one of 25 crypto hacks recorded in April. Combined losses across the industry reportedly reached about $630 million during the month, making it one of the worst months for crypto security since the $1.5 billion Bybit hack in February 2025.

The incident renewed attention on risks tied to cross-chain infrastructure and interconnected DeFi protocols. A vulnerability in one system can quickly affect lending markets, collateral flows and liquidity across several platforms.

Kelp DAO’s recovery process focused on restoring rsETH backing, reopening withdrawals and returning normal token operations. The protocol said it will continue monitoring system activity and publishing data tied to rsETH reserves.

The completion of the recovery plan marks a key step for Kelp DAO after weeks of disruption. The protocol’s next focus is expected to remain on maintaining stable rsETH operations, monitoring bridge activity and rebuilding user confidence after the exploit.