Catenaa, Monday, May 18, 2026- Kelp DAO and Aave has announced plans to gradually resume rsETH operations following initial recovery efforts tied to the $292 million exploit that struck Kelp DAO in April.
The protocols said stolen rsETH assets are being progressively restored while withdrawals, deposits and bridging services are expected to reopen in phases over the coming days.
Kelp DAO said 117,132 rsETH, matching the amount stolen during the April 18 exploit, will be replenished over two weeks through transfers involving the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on Ethereum mainnet.
The protocol said rsETH withdrawals could resume within 24 hours after the first transfer tranche is completed. Deposits, redemptions, bridging and claims are expected to follow once smart contracts are fully reactivated.
The exploit became the largest decentralized finance security breach recorded in 2026. Investigators and blockchain researchers widely linked the attack to Lazarus Group, a hacking group repeatedly accused of targeting cryptocurrency platforms globally.
After the attack, the exploiter used stolen rsETH as collateral on Aave to borrow wrapped ether, creating roughly $190 million in bad debt for the lending platform.
The incident triggered a broader recovery initiative called DeFi United, which raised more than $300 million worth of ether to stabilize the ecosystem and contain wider contagion risks.
The recovery process highlights growing coordination among decentralized finance platforms responding to large scale exploits and systemic blockchain security risks.
Kelp DAO said it completed major security upgrades across its LayerZero bridging systems, including increasing validator requirements and eliminating certain Layer 2 bridging routes.
The protocol also confirmed plans to migrate from LayerZero infrastructure toward Chainlink CCIP technology following criticism surrounding the exploit.
Meanwhile, legal disputes over frozen assets continue complicating the recovery process. The Arbitrum DAO previously froze roughly $72 million tied to the exploit, although multiple plaintiffs tied to earlier terrorism judgments against North Korea later sought control of those funds through US courts.
A federal court later allowed transfers to proceed temporarily while restricting movement or sale of the assets without additional judicial approval.
Security researchers said the exploit exposed weaknesses surrounding validator configurations and cross chain bridging infrastructure used across decentralized finance applications.
LayerZero publicly acknowledged failures in allowing insecure one of one DVN verification setups for high value transactions after initially disputing responsibility with Kelp DAO.
Industry analysts noted that cross chain bridges remain among the most vulnerable components inside decentralized finance ecosystems because they connect multiple blockchain networks and hold large concentrations of locked assets.
Researchers tracking crypto security trends also said institutional style recovery coordination involving protocols, governance organizations and legal systems is becoming increasingly common as decentralized finance markets mature.
The gradual reopening of rsETH services marks an important step toward stabilizing one of the largest decentralized finance security incidents of the year.
The recovery effort also highlights increasing pressure on blockchain infrastructure providers to strengthen security standards surrounding cross chain systems and validator architecture.
As decentralized finance grows more interconnected, the Kelp DAO exploit may become another major case shaping future security practices, governance coordination and legal oversight across the crypto industry.
Restaking protocols such as rsETH allow users to deposit ether and reuse staking assets across decentralized finance applications to generate additional yield. Cross chain bridges became central infrastructure within crypto markets by enabling assets to move between different blockchain networks. However, bridge systems also emerged as major security targets because they often manage large pools of locked cryptocurrency.
North Korea linked hacking groups including Lazarus have repeatedly been accused by governments and blockchain investigators of targeting crypto platforms to obtain digital assets used for sanctions evasion and state financing. Decentralized finance protocols increasingly rely on governance organizations, emergency security councils and collaborative recovery initiatives after major exploits occur.
The Kelp DAO incident became one of the largest DeFi security breaches of 2026 and intensified scrutiny surrounding validator systems, interoperability protocols and cross chain security standards.
