Kelp DAO Restores rsETH 5 Weeks After $293M Protocol Hack

Kelp DAO confirmed that rsETH backing has been fully restored to 100%, approximately five weeks after a $293 million exploit drained 116,500 of the liquid restaking tokens from the protocol on April 18, 2026.

The protocol announced on May 26 that a final tranche of 20,373.7 rsETH had been sent to LayerZero’s smart contract, closing what Kelp DAO called “the operational part of the rsETH recovery plan.” Mints, redemptions, and rewards are now running normally, according to the team.

rsETH traded at $2,229 at press time, down 0.48% over 24 hours, with a market cap of $1.36 billion.

How 116,500 rsETH Were Drained in 46 Minutes

The April 18 exploit was the largest crypto hack of 2026. Attackers forged a LayerZero cross-chain message, draining 116,500 rsETH, roughly 18% of the token’s circulating supply. Kelp DAO froze its contracts 46 minutes after the exploit began.

The attack was attributed to North Korea’s Lazarus Group (TraderTraitor unit). The attackers compromised LayerZero’s DVN RPC nodes, swapped binaries, and DDoS’d uncompromised nodes to force failover to poisoned ones.

The fallout extended well beyond Kelp DAO. The attacker deposited 89,567 rsETH as collateral on Aave V3/V4 to borrow ETH, leaving the lending protocol with roughly $190 million in bad debt. Aave’s TVL dropped from $26.4 billion to below $14 billion in the aftermath, a crisis that rattled DeFi markets already navigating broader macro uncertainty.

Arbitrum’s Security Council froze approximately $71 million (30,766 ETH) linked to the exploit at law enforcement’s request. Aave LLC filed an emergency federal court motion; the court allowed Arbitrum to transfer the ETH to Aave but barred asset sales pending further review.

DeFi United Coalition and the Five-Week Recovery

A coalition called DeFi United, led by Aave, coordinated the multi-protocol recovery effort. The group raised over $300 million in ETH to re-collateralize rsETH.

The first tranche of 25,000 rsETH was transferred on May 13, reopening bridging between Ethereum mainnet and L2 networks. Withdrawals followed the next day, on May 14.

The May 26 final transfer of 20,373.7 rsETH completed the plan. “Restored” in this context means rsETH is once again fully backed 1:1, with all core functions (mints, redemptions, bridging, rewards) operational.

LayerZero Admits Fault as Kelp Migrates to Chainlink

LayerZero eventually admitted it “made a mistake” by allowing its own DVN to secure high-value assets in a 1-of-1 configuration. At the time of the hack, 47% of active LayerZero OApp contracts used that same vulnerable setup.

Kelp DAO is now migrating rsETH from LayerZero’s OFT standard to Chainlink’s CCIP, making it the first major protocol to leave LayerZero since the exploit. Zach Rynes, Chainlink Labs’ strategic initiatives lead, noted that DeFi teams conducting security reviews are increasingly replacing older oracle and bridge systems with Chainlink infrastructure.

According to unconfirmed analyst estimates, total value migrated away from LayerZero across all protocols (including Solv, Kraken, and Re) may exceed $3 billion. If accurate, this signals a structural shift in how DeFi protocols approach cross-chain bridge security, similar to how Web3 users increasingly prioritize security features when selecting infrastructure tools.

What the Recovery Means for Liquid Restaking

rsETH is a liquid restaking token (LRT), a wrapper that lets holders earn staking yields while keeping their ETH liquid for use across DeFi. The hack tested whether a major LRT could survive losing 18% of its circulating supply and still make users whole.

The five-week timeline suggests that coordinated DeFi-native recovery is possible at scale, but the process required extraordinary measures: a multi-protocol coalition, over $300 million in emergency capital, and judicial intervention on Arbitrum. These are not repeatable for smaller protocols.

The broader crypto market reflects lingering caution. The Fear & Greed Index sits at 34, firmly in “Fear” territory, after April 2026 saw $630 million in DeFi exploits. Even as Bitcoin tests resistance near $80,000, the restaking sector faces persistent questions about bridge infrastructure and single points of failure.

Kelp DAO’s migration to Chainlink CCIP and the DeFi United coalition’s success in re-collateralizing rsETH set a precedent. Whether that precedent holds depends on whether the industry addresses the root cause: nearly half of all LayerZero-connected contracts relied on the same vulnerable architecture that enabled the largest hack of 2026.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.