Quick Summary
- Recovery process initiated by Kelp DAO and Aave following $292M security breach
- Phased restoration plan will distribute 117,132 rsETH over 14-day period
- Aave completes critical recovery milestones on Arbitrum network
- Enhanced security protocols implemented before resuming full operations
- Withdrawal functionality expected to return as final recovery stages progress
Following the completion of critical recovery measures from a $292 million security incident, Kelp DAO and Aave have initiated efforts to restore rsETH functionality. The two protocols plan to redistribute 117,132 rsETH through the LayerZero OFT adapter during a 14-day timeline. This represents a significant milestone in reactivating essential services including withdrawals, deposits, redemptions, cross-chain transfers, and user claims.
Phased Distribution Strategy Announced
According to Kelp DAO, the restoration funds will originate from both the Aave Recovery Guardian and Kelp Recovery Safe. These assets will be transferred to the LayerZero OFT adapter on Ethereum’s main network through multiple installments. Once the initial distribution completes, Kelp anticipates reactivating withdrawal capabilities within a 24-hour window.
The organization emphasized that rsETH tokens on both the primary network and secondary Layer 2 platforms maintain complete collateral backing. Nevertheless, standard functionality will only restart after smart contract systems return to active status. This encompasses all deposit mechanisms, token redemptions, cross-chain bridging, and claim processing across all supported blockchain networks.
Additionally, Kelp conducted comprehensive security enhancement reviews of its LayerZero bridge infrastructure. The updated framework now mandates four separate attestor confirmations alongside 64 block verifications. The protocol has also eliminated all direct Layer 2-to-Layer 2 pathways to minimize potential cross-chain vulnerabilities.
Aave Completes Critical Recovery Milestones
Aave has verified the successful completion of initial recovery procedures connected to the security breach. This involved eliminating the attacker’s rsETH holdings on Arbitrum following coordinated recovery actions. The platform is now positioned to facilitate the gradual refill into the mainnet adapter system.
The April 18 security incident resulted in the loss of 117,132 rsETH and caused disruptions throughout multiple DeFi platforms. The perpetrator converted a portion of the stolen tokens into collateral on Aave for WETH borrowing. This transaction generated approximately $190 million in uncollateralized debt for the lending platform.
Subsequently, Aave participated in establishing DeFi United to prevent broader market instability. The alliance secured over $300 million in ETH pledges from prominent DeFi organizations. Consequently, the restoration initiative obtained sufficient backing to address the rsETH collateral shortfall.
Ongoing Legal Proceedings
The Arbitrum Security Council immobilized approximately 30,766 ETH associated with the perpetrator on April 20. These funds were designated to support the DeFi United restoration initiative. However, subsequent legal challenges in U.S. courts have postponed the asset transfer timeline.
Multiple plaintiffs holding terrorism-related judgments against North Korea have pursued control of the frozen ETH. They maintain that the Lazarus Group executed the exploit on behalf of the North Korean government. Aave contested this legal action, asserting that stolen assets should be returned to impacted users.
A Manhattan federal court subsequently authorized Arbitrum to move ETH to an Aave-controlled address. However, Aave remains restricted from liquidating or transferring these funds pending additional court authorization. Concurrently, Kelp is transitioning its rsETH bridging infrastructure from LayerZero to Chainlink CCIP for enhanced security capabilities.





