Kelp DAO has completed the operational phase of its rsETH recovery plan more than five weeks after the Ethereum liquid staking protocol lost $293 million in a hack that investigators linked to North Korea’s Lazarus Group. Summary Kelp DAO has completed the final operational step in its rsETH recovery plan after April’s $293 million exploit linked to Lazarus Group. Aave’s lending markets are still recovering after attackers used stolen rsETH as collateral to borrow wrapped Ether and leave nearly $190 million in bad debt. According to a Monday statement posted by Kelp DAO on X, the protocol transferred the final batch of 20,373.7 rsETH to the LayerZero smart contract responsible for handling token locking, minting, burning, and releases during cross-chain transfers. The final tranche of 20,373.72 rsETH has been sent to the rsETH OFT adapter earlier today. This closes the operational part of the rsETH recovery plan.Tx: https://t.co/fB2HLWvggk— Kelp (@KelpDAO) May 25, 2026 Kelp DAO said the move completed the final operational step required to restore rsETH backing after the April 18 exploit drained 116,500 rsETH from its bridge infrastructure. Kelp DAO had already reopened withdrawals and resumed rsETH bridging between the Ethereum mainnet and supported layer 2 networks after transferring an initial tranche of 25,000 rsETH on May 13. Quick update: The first tranche of rsETH has been transferred by @aave into the LayerZero OFT Adapter per the coordinated restart plan agreed with Kelp. Bridging is now resumed. Users can move rsETH in and out of L2s from mainnet freely now.1. rsETH contracts will be…— Kelp (@KelpDAO) May 13, 2026 In its latest update, the protocol added that rsETH minting, redemptions, and reward functions are now operating normally again. Funds used to restore the token backing came partly through the DeFi United recovery initiative, where multiple decentralized finance protocols coordinated support following the exploit. Aave still dealing with aftermath of exploit In the meantime, the fallout from the Kelp DAO attack continues to weigh on lending activity tied to Aave. After the exploit, attackers deposited a large portion of the stolen rsETH into Aave as collateral and borrowed wrapped Ether against it. Court filings and governance documents previously stated that the incident left nearly $190 million in bad debt across affected Aave markets. In the weeks that followed, DefiLlama data showed Aave’s total value locked dropped from more than $26 billion to below $14 billion as users withdrew liquidity from lending pools. Although outflows have slowed over the past month, the protocol’s TVL has remained largely rangebound between roughly $13.9 billion and $15.1 billion. AAVE TVL. Source: DefiLlama. Recent governance actions have restored some protocol functions. On May 18, Aave founder Stani Kulechov confirmed that borrowing against wrapped Ether collateral had resumed across several Aave V3 deployments, including Ethereum, Arbitrum, Base, Mantle, and Linea. Governance participants had earlier approved emergency restrictions after the exploit allowed unbacked rsETH to enter lending markets. LayerZero dispute and legal battle continue At the same time, legal disputes tied to frozen Ether connected to the incident are still unresolved. Earlier court filings showed that approximately 30,765 ETH, valued at nearly $71 million when frozen by the Arbitrum Security Council on April 21, became the subject of competing legal claims after blockchain analytics firms attributed the exploit to North Korean-linked actors. Gerstein Harrow LLP, representing families pursuing terrorism-related judgments against North Korea, argued in court that the assets could qualify as property tied to Lazarus Group activity. Aave has disputed that interpretation, stating in filings that no court has formally determined North Korea or Lazarus Group carried out the exploit and that the recovered assets belong to affected users. Separate tensions also emerged between Kelp DAO and LayerZero after the exploit. Earlier this month, Kelp DAO announced plans to migrate rsETH infrastructure from LayerZero’s OFT framework to Chainlink’s Cross-Chain Interoperability Protocol. Kelp DAO said the migration was part of efforts to strengthen bridge security following the attack. LayerZero co-founder and CEO Bryan Pellegrino, however, has rejected several claims made by Kelp DAO regarding bridge configurations and security approvals. A ton of this is just completely untrue. 1) Kelp originally used the defaults which were MultiDVN or DeadDVN and manually migrated to a 1/1 config later2) Almost 100% of the volume on a 1/1 config was rsETH3) Not using a 1/1 for production applications is mentioned many… pic.twitter.com/pDCc4Z5M1K— Bryan Pellegrino (臭企鹅) (@PrimordialAA) May 5, 2026
