Kelp DAO Begins rsETH Recovery, Plans to Restore 117,132 Tokens Over Two Weeks

Suehyeon Lee

Summary

Kelp DAO and Aave said they will restore 117,132 rsETH worth about $278 million in stages over two weeks after the hack.
Kelp DAO said it moves and manages rsETH collateral through a multisig wallet and a LayerZero (ZRO)-based bridge contract, adding that sufficient collateral is always maintained across mainnet and Layer 2 networks.
Kelp DAO said it will resume withdrawals within 24 hours after the first recovery tranche is reflected, normalize rsETH-related functions, strengthen bridge verification, and pursue the adoption of Chainlink CCIP to bolster security.

Forecast Trend Report by Period

Kelp DAO, a decentralized finance platform, and DeFi lending protocol Aave have begun restoring collateral affected by a hacking incident.

Cointelegraph reported on May 13 that Kelp DAO burned rsETH, the restaking token used in the attack, on the Arbitrum network.

The recovery covers 117,132 rsETH, worth about $278 million at current prices. The collateral will be replenished in stages over the next two weeks.

Recovery funds will be transferred from a multisig wallet managed by the DeFi United recovery group and Kelp DAO to a LayerZero-based bridge contract. The contract manages rsETH issuance, burning and transfers across chains.

Kelp DAO said rsETH circulating on mainnet and Layer 2 networks remains fully backed by sufficient collateral.

Kelp DAO previously suffered a hack worth about $293 million in April. The attacker exploited a vulnerability in the rsETH bridge contract to steal funds, and LayerZero identified North Korean hacking group Lazarus as being behind the attack.

Security firm OpenZeppelin said at the time that the main cause appeared to be an operational failure rather than a bug in a specific smart contract.

Kelp DAO plans to resume withdrawals within 24 hours after the first recovery tranche is reflected. Deposits, repayments, bridge functions and compensation claims tied to rsETH will also be restored afterward.

The protocol has also tightened security. Bridge verification now requires four independent validators and a 64-block confirmation process, while some Layer 2 routes have been suspended. Kelp DAO also said it is pursuing adoption of Chainlink's CCIP, or Cross-Chain Interoperability Protocol, to strengthen security further.