Kelp DAO prepares to resume withdrawals following destruction of hacker's rsETH tokens on Arbitrum
Following the burning of exploited tokens on Arbitrum, Kelp DAO has initiated a comprehensive rsETH recovery process with Aave, launching a 14-day period to restore backing through dedicated recovery wallets.
The Ethereum-based liquid restaking platform Kelp, in collaboration with Aave, a decentralized lending protocol, has successfully executed multiple recovery procedures aimed at restoring full backing to rsETH, which included the destruction of tokens held by the exploiter.
On Tuesday, Kelp DAO provided an extensive update regarding the post-exploit recovery process for its liquid staking token rsETH, verifying that the exploiter's tokens have been successfully burned on Arbitrum, a layer-2 network.
The total amount of 117,132 rsETH, presently valued at approximately $278 million, is scheduled to be gradually refilled throughout a two-week timeline from the Aave Recovery Guardian, which operates as a multisignature wallet under the control of the DeFi United recovery group, and Kelp's own recovery safe, transferring into the LayerZero OFT adapter—a smart contract responsible for managing the locking, minting, burning and releasing of rsETH during transfers across different chains.
Kelp DAO has verified that rsETH across mainnet and various layer-2 networks, which currently holds a market capitalization of $1.5 billion, continues to maintain full backing without interruption.
This recovery initiative for the liquid staking tokens represents a significant advancement toward full restitution for users who were affected by what stands as one of the most substantial DeFi exploits recorded this year.
The Kelp platform suffered a security breach in April when threat actors, commonly attributed to North Korea's Lazarus Group, successfully exploited vulnerabilities in its rsETH adapter bridge contract—the software responsible for managing the platform's liquid restaking token—resulting in the drainage of approximately $293 million.
At that time, blockchain security company OpenZeppelin disclosed that no technical smart contract vulnerability had been publicly discovered, noting that "the system failed operationally," representing a risk category that the DeFi industry has "consistently underweighted."
Withdrawals will resume within 24 hours
According to Kelp, the protocol will reactivate withdrawals, "tentatively within 24 hours," following the return of the initial tranche to the smart contract. Following the reactivation of the contracts, all rsETH operations—encompassing deposits, redemptions, bridging and claims—will return to normal functionality.
The platform has additionally finalized a "security hardening pass," with bridging security now mandating four independent attestors along with 64 block confirmations, and has discontinued certain layer-2 routes.
The protocol is currently undertaking a migration to Chainlink's Cross-Chain Interoperability Protocol (CCIP) to achieve "further strengthened cross-chain bridging."
Derivatives traders undeterred by DeFi hacks
As a leading liquid restaking protocol operating on Ethereum, Kelp is constructed primarily on top of EigenLayer, enabling users to deposit ETH or other compatible liquid staking tokens in exchange for additional yields.
The total value locked within the protocol reached an all-time high of slightly above $2 billion in September 2025 but has subsequently experienced a decline of approximately 26% to $1.55 billion, based on data from DeFiLlama.
Earlier this week, Cointelegraph reported that market metrics demonstrated ETH derivatives traders were maintaining their positions and have not turned bearish in spite of the recent DeFi exploits.
Nevertheless, spot prices have experienced a decrease of around 1% throughout the day, with Ether dropping to a 12-day low of $2,260 during late trading hours on Tuesday.