Kelp DAO reopens rsETH withdrawals after $293M Lazarus Group bridge exploit

Kelp DAO says rsETH withdrawals could resume within 24 hours after it and Aave completed a key recovery step, burning the Lazarus Group-linked exploiter’s tokens on Arbitrum and launching a $278 million replenishment process to fully recapitalise the protocol.

The recovery effort, announced Tuesday, comes after attackers’ rsETH tokens on Arbitrum were burned and a coordinated replenishment process was launched with support from Aave.

The exploit, widely attributed to North Korea-linked Lazarus Group actors by blockchain investigators, exposed vulnerabilities in cross-chain DeFi infrastructure and triggered liquidity stress across multiple lending markets.

Kelp DAO now says rsETH remains “fully backed” and that normal operations could resume within a day once the first recovery tranche is restored to the protocol.

Kelp DAO begins recovery after bridge exploit

According to Kelp DAO, approximately 117,132 rsETH, currently valued near $278 million will be progressively restored over a two-week period through Aave’s Recovery Guardian multisignature wallet and Kelp’s own recovery infrastructure.

The funds will move into the LayerZero OFT adapter, the smart contract responsible for minting and transferring rsETH across chains.

“Kelp and Aave have successfully completed a series of steps for rsETH backing, including burning the exploiter’s rsETH on Arbitrum.” – Kelp DAO said in a public statement.

The platform added that withdrawals would be “tentatively within 24 hours” of the first tranche being restored to the contract infrastructure.

The exploit originally occurred on April 18, when attackers manipulated Kelp DAO’s LayerZero-powered bridge system and drained approximately 116,500 rsETH.

Security firms including Cyvers and OpenZeppelin later said the attack appeared tied less to a traditional smart contract flaw and more to operational weaknesses in cross-chain verification systems.

Aave containment efforts helped stabilize markets

Attackers used the stolen rsETH as collateral across DeFi lending markets, particularly on Aave, borrowing substantial amounts of Ether and creating fears of systemic bad debt exposure.

Aave responded by freezing rsETH markets on multiple deployments of its lending protocol, while other DeFi platforms paused related services to limit contagion risk.

Blockchain analytics firms estimated the exploit temporarily threatened hundreds of millions of dollars in liquidity across Ethereum-based lending ecosystems.

Recovery efforts accelerated after Aave liquidated the attacker’s remaining rsETH positions on Ethereum and Arbitrum.

The seized collateral was transferred into recovery-controlled wallets designed to help recapitalize the ecosystem and reduce protocol losses.

Arbitrum governance also intervened during the crisis, freezing tens of millions of dollars tied to the exploit in what analysts described as one of the most effective containment actions during the incident.

Security upgrades aim to reassure investors

Kelp DAO says it has now implemented additional security protections before resuming operations.

The protocol stated that cross-chain bridging now requires four independent attestors and 64 block confirmations, while several layer-2 routing paths have been deprecated.

The platform is also migrating toward Chainlink’s Cross-Chain Interoperability Protocol (CCIP) in an effort to strengthen bridge security and reduce reliance on vulnerable verification setups.

Industry observers say the incident may reshape how DeFi protocols approach interoperability and collateral management.

Several analysts noted that many cross-chain systems continue operating with limited validator redundancy, increasing systemic risks during coordinated attacks.

The attack also renewed scrutiny around Ethereum restaking and yield-layered products tied to protocols like EigenLayer, which underpin Kelp DAO’s rsETH ecosystem.

Despite the disruption, derivatives traders have largely avoided a broader bearish reaction in Ether markets, according to recent market data cited by Cointelegraph.

Still, Kelp DAO’s total value locked has fallen sharply from its 2025 peak above $2 billion to roughly $1.55 billion following the exploit.