Arbitrum's rsETH purge paves way for Kelp DAO to potentially lift withdrawal freeze

In a significant development, Kelp, a leading Ethereum-based liquid restaking platform, and Aave, a prominent decentralized lending protocol, have successfully completed a comprehensive recovery plan to restore the backing of rsETH, a liquid staking token. This move follows a major hack in April, attributed to North Korea's Lazarus Group, which resulted in the theft of approximately $293 million. As part of the recovery efforts, the exploiter's rsETH tokens, valued at around $278 million, have been burned on the Arbitrum network, a layer-2 scaling solution.

The burned tokens, totaling 117,132 rsETH, will be progressively replenished over a two-week period through a multisignature wallet controlled by the DeFi United recovery group and Kelp's own recovery safe. This wallet will transfer the funds to the LayerZero OFT adapter, a smart contract responsible for managing rsETH during cross-chain transfers. Kelp DAO has confirmed that the rsETH token, which has a market capitalization of $1.5 billion, remains fully backed on both the mainnet and layer-2 networks.

The recovery plan is expected to bring relief to users affected by one of the largest DeFi exploits of the year. The hack, which occurred in April, was attributed to operational failures rather than a smart contract bug, according to blockchain security firm OpenZeppelin. This incident highlights the importance of addressing operational risks in the DeFi industry, which have been consistently underestimated.

In the aftermath of the hack, Kelp has implemented significant security enhancements, including a "security hardening pass" that requires four independent attestors and 64 block confirmations for bridging transactions. The protocol has also deprecated certain layer-2 routes and is in the process of migrating to Chainlink's Cross-Chain Interoperability Protocol (CCIP) to further strengthen its cross-chain bridging capabilities.

As a result of these efforts, Kelp expects to resume withdrawals within the next 24 hours, with all rsETH operations, including deposits, redemptions, and claims, set to return to normal once the contracts are reactivated. The protocol's total value locked, which peaked at $2 billion in September 2025, has declined by approximately 26% to $1.55 billion, according to DeFiLlama. Despite recent DeFi exploits, derivatives traders remain undeterred, with metrics showing that $ETH derivatives traders have maintained their positions, even as spot prices have fallen by around 1% to a 12-day low of $2,260.