Kelp DAO says the operational phase of its rsETH recovery plan is now complete. The update comes more than five weeks after the April 18 exploit that drained 116,500 rsETH from the protocol’s bridge infrastructure, an incident reported at roughly $293 million. Investigators had previously linked the attack to North Korea’s Lazarus Group.
In a statement posted Monday on X, Kelp DAO said it transferred the final 20,373.7 rsETH to the LayerZero smart contract that handles token locking, minting, burning, and releases during cross-chain transfers. That move completed the last operational step needed to restore rsETH backing. The protocol had already sent an initial 25,000 rsETH on May 13, reopening withdrawals and restarting rsETH bridging between the Ethereum mainnet and supported layer 2 networks.
Minting, redemptions, and rewards are back online
In its latest update, Kelp DAO said rsETH minting, redemptions, and reward functions are now operating normally. Part of the capital used to restore token backing came through the DeFi United recovery initiative, where several DeFi protocols coordinated support after the exploit.
That closes the protocol’s core recovery work. The wider damage from the incident is still being worked through, especially in lending markets where stolen rsETH had been posted as collateral.
Aave is still working through bad debt and lower TVL
After the exploit, attackers deposited a large share of the stolen rsETH into Aave and borrowed wrapped Ether against it. Court filings and governance documents had previously said the event left nearly $190 million in bad debt across affected Aave markets.
Data from DefiLlama showed Aave’s total value locked fell from more than $26 billion to below $14 billion in the weeks that followed as users pulled liquidity from lending pools. Outflows have slowed over the last month, but TVL has largely stayed within a band of roughly $13.9 billion to $15.1 billion. Some functions have returned. On May 18, Aave founder Stani Kulechov said borrowing against wrapped Ether collateral had resumed across several Aave V3 deployments, including Ethereum, Arbitrum, Base, Mantle, and Linea. Governance participants had approved emergency restrictions earlier after unbacked rsETH entered lending markets.
Frozen ETH claims and bridge dispute remain open
Legal disputes tied to frozen Ether from the incident are still unresolved. Earlier court filings showed that about 30,765 ETH, valued at nearly $71 million when frozen by the Arbitrum Security Council on April 21, became the subject of competing claims after blockchain analytics firms attributed the exploit to actors linked to North Korea.
Gerstein Harrow LLP, which represents families seeking terrorism-related judgments against North Korea, argued in court that the assets could qualify as property connected to Lazarus Group activity. Aave challenged that view in its filings, saying no court has formally determined that North Korea or Lazarus Group carried out the exploit and that recovered assets belong to affected users.
Tensions between Kelp DAO and LayerZero have also surfaced. Earlier this month, Kelp DAO said it plans to migrate rsETH infrastructure from LayerZero’s OFT framework to Chainlink’s Cross-Chain Interoperability Protocol as part of its post-attack bridge security work. LayerZero co-founder and CEO Bryan Pellegrino has disputed several of Kelp DAO’s claims about bridge configuration and security approvals.