Ethereum-based liquid restaking protocol Kelp and decentralized lending platform Aave have successfully completed a major recovery operation to fully restore the security of rsETH tokens following a devastating cyberattack in recent months. With a current market capitalization of $1.5 billion, rsETH remains fully collateralized across all networks. Over the next two weeks, a total of 117,132 rsETH—worth approximately $278 million—will be gradually reintroduced into the system.
Recovery protocol and token burns
Kelp DAO announced that, following the cyberattack in April, all rsETH tokens linked to the hacker were irreversibly burned on the Arbitrum network. This decisive action aimed to eliminate the attacker’s influence within the ecosystem and restore community trust.
To replenish the burned tokens, a multi-signature wallet managed by the Aave Recovery Guardian and Kelp’s internal security wallet will jointly transfer a total of 117,132 rsETH. The transfers, executed via smart contracts, are scheduled to be completed within about two weeks.
Kelp DAO representatives emphasized that rsETH tokens, actively circulated on mainnet and all layer-2 networks, retain a market value of around $1.5 billion and are always fully backed by collateral.
Background of the attack and enhanced protection
Last April, Kelp fell victim to a major cyberattack attributed to North Korea-linked Lazarus Group. In that incident, a vulnerability in the rsETH adapter bridge contract allowed $293 million to be illicitly withdrawn from the system. While blockchain security firm OpenZeppelin found no critical smart contract flaws in its subsequent report, it cited basic operational weaknesses in the protocol’s processes.
Following these losses, Kelp DAO implemented comprehensive “security reinforcement” measures. Now, bridge transactions require validation from four independent parties and confirmation across 64 blocks, with certain layer-2 transfers temporarily suspended. Preparations are also under way to migrate the bridge infrastructure to Chainlink’s cross-chain protocol.
Market status and user impact
As of today, the total value locked in Kelp’s protocol has dropped to $1.55 billion. According to DeFiLlama, this figure peaked above $2 billion in September 2025 before falling in the wake of the hack and subsequent security concerns.
The ongoing recovery process is designed to ensure smooth asset access for affected users. Kelp’s management confirmed that withdrawal services will be restored within 24 hours of the first smart contract transfer. Once finalized, all deposit, withdrawal, bridging, and redemption operations for rsETH will return to normal.
According to Kelp DAO, “Once the initial phase is complete, withdrawals will temporarily reopen; afterwards, all rsETH operations will resume their usual course.”
Kelp is built on Ethereum with EigenLayer infrastructure, promising users additional returns from ETH and other liquid staking tokens. The protocol is known for supplying high liquidity within the DeFi sector.
Despite recent events, data reported by Cointelegraph suggests that investors in Ethereum derivatives have not adopted a particularly pessimistic stance. However, spot Ether prices have slumped to $2,260, the lowest level in the past twelve days.
