Ethereum liquid restaking platform Kelp and decentralized lending protocol Aave have completed a series of steps to restore rsETH backing, including burning the exploiter’s rsETH tokens.
Kelp DAO detailed a post-exploit recovery for its liquid staking token rsETH on Tuesday, confirming that the hacker’s tokens were burned on the layer-2 Arbitrum network.
The 117,132 rsETH — worth about $278 million at current prices — will be progressively restored over two weeks using funds from the Aave Recovery Guardian multisignature wallet, which is controlled by the DeFi United recovery group and Kelp’s own recovery safe.
The funds will be routed through the LayerZero OFT adapter, the smart contract responsible for locking, minting, burning and releasing rsETH during cross-chain transfers.
Kelp DAO confirmed that rsETH on mainnet and layer-2 networks, which has a market capitalization of $1.5 billion, remains fully backed at all times.
The move to recover the liquid staking tokens will bring users impacted by one of this year’s largest DeFi exploits one step closer to recovery.
Kelp was hacked in April when attackers widely attributed to North Korea’s Lazarus Group exploited its rsETH adapter bridge contract, the software that manages the platform’s liquid restaking token, and drained about $293 million.
Blockchain security firm OpenZeppelin reported at the time that no smart contract bug had been publicly identified, adding that “the system failed operationally,” and this is a category of risk the DeFi industry has “consistently underweighted.”
Tracking the exploited funds. Source: Cyvers
Withdrawals will resume within 24 hours
Kelp said it will unpause withdrawals, “tentatively within 24 hours,” after the first tranche is returned to the smart contract. All rsETH operations, including deposits, redemptions, bridging and claims, will resume as usual after the contracts are reactivated.
The protocol has also completed a “security hardening pass,” and bridging security now requires four independent attestors and 64 block confirmations, while it has deprecated some layer-2 routes.
Related: At least a dozen crypto entities attacked since Drift Protocol hack
It is also in the process of migrating to Chainlink’s Cross-Chain Interoperability Protocol (CCIP) for “further strengthened cross-chain bridging.”
Derivatives traders undeterred by DeFi hacks
Kelp is a prominent liquid restaking protocol on Ethereum, primarily built on top of EigenLayer, where users deposit ETH or other supported liquid staking tokens for additional yields.
The protocol’s total value locked hit an all-time high of just over $2 billion in September 2025 but has since declined by about 26% to $1.55 billion, according to DefiLlama.
Cointelegraph reported this week that ETH derivatives traders have largely remained unfazed by the recent wave of DeFi exploits, with professional sentiment holding steady despite elevated security concerns.
Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks
