Kelp DAO rsETH recovery ends: final LayerZero adapter transfer closes the fix

Kelp DAO rsETH recovery has reached its operational finish line, ending a five-week effort to stabilize the liquid staking token after a $293 million exploit shook the protocol and rippled through parts of decentralized finance.

The final step was specific: 20,373.72 rsETH was sent to the LayerZero OFT adapter, the mechanism used for cross-chain transfers of the token. That transfer matters because it marks the end of the main restoration work after an April 18 attack that reports linked to North Korea’s Lazarus Group.

For users and DeFi watchers, this was bigger than one protocol’s cleanup job. The breach hit Kelp DAO directly, but it also spilled into Aave, where stolen rsETH was used as collateral and helped create a broader stress event across lending markets.

Kelp DAO says the rsETH recovery is complete

Kelp DAO said it completed the operational phase of its rsETH recovery plan as of May 26, 2026.

That milestone came five weeks after the exploit disrupted the protocol and several DeFi markets. Reports tied the April 18 attack to Lazarus Group, although the link was described in reports rather than independently established in Kelp’s update.

Kelp said rsETH minting, redemptions, and rewards are now running normally again. Withdrawals had already reopened earlier this month, signaling that the protocol had moved from emergency response into a more regular operating mode.

In practice, that makes the Kelp DAO rsETH recovery more than a technical milestone. It now has direct implications for users who need liquidity, for token holders watching backing and redemption mechanics, and for lending platforms that had exposure during the crisis.

How the LayerZero exploit recovery was carried out

The final tranche of 20,373.72 rsETH was sent to the LayerZero OFT adapter, which Kelp described as the infrastructure responsible for locking, minting, burning, and releasing rsETH during cross-chain transfers.

That was not the only refill step. Over the past two weeks, about 116,000 rsETH was put back into the adapter by Aave and Kelp as part of the broader recovery effort.

The timeline moved in stages:

• A first tranche of 25,000 rsETH was transferred on May 13, allowing rsETH bridging between Ethereum mainnet and Layer 2 networks to resume.
• Withdrawals reopened on May 14, and the final 20,373.72 rsETH transfer completed the main operational phase.

Kelp also said several crypto protocols helped restore backing through the DeFi United initiative.

Why this matters is straightforward: cross-chain tokens live or die on trust in their transfer and backing mechanisms. In this case, the Kelp DAO rsETH recovery was not just about replacing missing assets. It was about restoring the machinery that lets rsETH move across Ethereum and Layer 2 networks without freezing the user experience.

What the exploit did to Aave and the wider market

The damage did not stop at Kelp DAO.

A large amount of stolen rsETH was deposited into Aave as collateral, then used to borrow wrapped Ether. That move pushed stress into Aave’s lending pools and turned a protocol exploit into a market-wide DeFi problem.

Reports from the incident estimated that about 116,500 stolen rsETH was involved in that process. Aave was left with around $190 million in bad debt after the exploit, one of the clearest examples of how collateral contagion can spread when tokens move across multiple protocols.

Aave and Kelp later refilled roughly 116,000 rsETH into the adapter over two weeks, and Aave said rsETH and all Aave markets are now operating normally. The platform also confirmed that the final rsETH tranche had been sent to the LayerZero lockbox.

That sequence is important because it shows how interconnected DeFi has become. A bridge exploit can quickly become a lending crisis when the stolen asset is accepted as collateral elsewhere. In practical terms, the Kelp DAO rsETH recovery became an Aave stability issue too, which is why the fix required coordination rather than isolated patchwork.

Why the Kelp DAO rsETH recovery puts cross-chain risk back in focus

The exploit was one of 25 crypto hacks recorded in April, underscoring how security failures in one part of the stack can hit users and markets far beyond the original target.

In this case, the attack targeted Kelp DAO’s bridge infrastructure through a forged LayerZero packet, allowing attackers to move rsETH across chains and later use it inside lending markets. That combination of bridge risk and collateral reuse is what made the incident especially damaging.

The lesson from the aftermath is hard to miss: token backing, bridge mechanics, and lending market health are now tightly linked. When one breaks, the damage can show up in withdrawals, redemptions, and bad debt almost immediately.

For now, Kelp says normal operations have resumed. Still, the broader significance of this episode is that recovery in DeFi no longer ends when a protocol patches a bug. It ends only when the token works again, the collateral system stops bleeding, and the wider market believes the plumbing is safe enough to trust.