Kelp DAO Finalizes rsETH Recovery Following $293M Lazarus Group Exploit

In a significant milestone, Kelp DAO, a prominent liquid staking platform built on Ethereum, has successfully completed its operational recovery phase, marking a major turning point five weeks after a devastating $293 million security breach attributed to the infamous Lazarus Group, a notorious North Korean hacking outfit. As of May 25, the protocol has fully restored its restaked Ether tokens, known as rsETH, with the final allocation of 20,373.72 rsETH being transferred to the LayerZero OFT adapter, a critical infrastructure component that facilitates seamless token transfers and liquidity management across multiple blockchain networks.

This concluding transfer culminated an extensive replenishment campaign that saw approximately 116,000 rsETH restored to the adapter over a two-week period, with significant support from Aave and other participating protocols in the DeFi United recovery coalition. According to Kelp's real-time monitoring dashboard, the platform has achieved a remarkable 100.01% ETH backing ratio, accompanied by complete bridge lockbox coverage, leveraging both LayerZero and Chainlink systems to ensure maximum security and transparency.

All essential services, including minting, redemption processing, and reward distribution, have been functioning without interruption since withdrawal capabilities were restored on May 14, a testament to the platform's swift recovery efforts. The Lazarus Group's security breach on April 18 had extracted 116,500 rsETH tokens valued at approximately $293 million, with the exploiter subsequently using a substantial portion of these stolen assets as collateral on Aave's decentralized lending platform to extract wrapped Ether loans, resulting in $190 million in uncollateralized debt and triggering widespread panic withdrawals.

The incident had far-reaching consequences, with Aave's total value locked plummeting from $26.4 billion to under $14 billion, causing the protocol to relinquish its status as the largest DeFi platform by TVL. The Kelp DAO breach was one of 25 documented cryptocurrency exploits in April, with aggregate losses totaling $630 million, making it the sector's worst month since Bybit suffered a $1.5 billion hack in February 2025.

While Aave's lending protocols have seen a moderation in net withdrawals over the past month, according to DefiLlama analytics, the platform's TVL has yet to demonstrate a meaningful rebound, fluctuating between $13.9 billion and $15.1 billion since approximately one week after the security incident. The initial allocation of 25,000 rsETH on May 13 had enabled the resumption of rsETH transfers between Ethereum's primary network and secondary layer 2 ecosystems, and with the operational recovery phase now officially concluded, Kelp DAO faces the more substantial challenge of restoring user trust.

Recent security incidents have heightened investor scrutiny regarding bridge security protocols, collateralization transparency, and financial solvency throughout restaking ecosystems, prompting platforms to deploy enhanced real-time reserve monitoring systems, proof-of-reserves verification mechanisms, and publicly auditable recovery wallet tracking. In a bid to demonstrate transparency and normalize operations, KelpDAO has directed community members to its live monitoring dashboard, providing verifiable proof that rsETH maintains full backing and operations have returned to normal.