Key Highlights
- Five weeks after North Korea’s Lazarus Group exploited the platform for $293 million, Kelp DAO has finalized the operational recovery of its rsETH token.
- A closing batch of 20,373.72 rsETH was deposited into the LayerZero OFT adapter, bringing cross-chain bridge reserves back to full capacity.
- Real-time tracking data reveals a 100.01% ETH collateralization rate, confirming complete backing for rsETH tokens.
- While Aave contributed resources to support the restoration effort, its total value locked continues to struggle at approximately $14 billion, far below its pre-attack level of $26.4 billion.
- Standard minting, withdrawal, and rewards distribution functions have been operational since May 14 when the protocol reopened.
Five weeks following a devastating $293 million security breach linked to North Korea’s Lazarus Group, Ethereum liquid staking platform Kelp DAO has announced the successful completion of its rsETH restoration initiative.
On May 25, the platform moved its concluding batch of 20,373.72 rsETH tokens into the LayerZero OFT adapter. This component handles token transfers and liquidity management across various blockchain networks.
This final deposit marked the completion of an extensive replenishment campaign that saw roughly 116,000 rsETH returned to the adapter during a two-week period, with assistance from Aave and additional protocols participating in the DeFi United recovery effort.
According to Kelp’s real-time monitoring system, the platform now maintains a 100.01% ETH collateralization ratio alongside complete bridge lockbox coverage via both LayerZero and Chainlink networks.
Kelp representatives confirmed that all core functions including token minting, redemptions, and rewards distribution have operated without interruption since withdrawal services resumed on May 14.
Details of the April Security Breach
The Lazarus Group successfully compromised the Kelp DAO infrastructure on April 18, extracting 116,500 rsETH tokens valued at approximately $293 million.
Following the theft, the attackers deployed a substantial portion of these stolen assets as loan collateral on Aave’s lending infrastructure to extract wrapped Ether. This maneuver saddled Aave with $190 million in uncollectible debt and sparked widespread panic withdrawals.
The incident caused Aave’s total value locked to plummet from $26.4 billion to under $14 billion, costing it the top spot among DeFi protocols ranked by TVL.
This Kelp DAO incident represented just one of 25 separate cryptocurrency security breaches documented in April. Total industry losses for that month climbed to $630 million, establishing it as the most damaging period since Bybit suffered a $1.5 billion compromise in February 2025.
Aave Still Struggling to Rebound
While withdrawal pressure on Aave’s lending infrastructure has diminished over recent weeks, DefiLlama statistics indicate the slowdown in outflows.
Nevertheless, Aave’s TVL has failed to show meaningful recovery signs. The metric has remained stuck in a range between $13.9 billion and $15.1 billion since approximately one week following the security incident.
The initial deployment of 25,000 rsETH occurred on May 13, which allowed rsETH bridging capabilities between Ethereum’s primary network and secondary scaling solutions to restart.
Kelp representatives state the operational recovery phase has now concluded. The more substantial challenge of restoring community trust lies ahead.
Recent security incidents have heightened investor scrutiny regarding bridge protection mechanisms, reserve transparency, and financial stability across restaking infrastructures.
Platforms have responded by allocating increased resources toward live reserve monitoring systems, verifiable backing mechanisms, and publicly auditable recovery addresses.
Kelp DAO has directed community members to its live monitoring dashboard as proof that the system is functioning properly and that rsETH maintains full collateralization.





