Kelp DAO and Aave Begin Restoring rsETH Operations Following $292M Exploit Recovery Efforts

Kelp DAO and Aave have started restoring rsETH-related operations following initial recovery efforts tied to the $292 million exploit that struck Kelp DAO in April, one of the largest DeFi security breaches of 2026.

Kelp DAO said it will progressively refill 117,132 rsETH — the amount stolen during the April 18 exploit — into the LayerZero OFT adapter on Ethereum mainnet over the next two weeks using assets from the Aave Recovery Guardian and Kelp Recovery Safe.

The protocol added that rsETH withdrawals are expected to resume within 24 hours after the first tranche is restored, while broader operations including deposits, redemptions, bridging, and claims will gradually return once smart contracts are unpaused.

Security Upgrades and Migration Away From LayerZero

As part of the recovery process, Kelp DAO said it has implemented security changes across its LayerZero bridging configurations.

The updates include:

• requiring four independent attestors for verification,

• increasing block confirmation requirements from 42 to 64,

• and removing all layer-2-to-layer-2 routes.

The protocol also confirmed it is migrating interoperability infrastructure from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol (CCIP), following earlier announcements made after the exploit.

Meanwhile, Aave confirmed that early stages of the recovery plan have been completed, including the burning of the exploiter’s rsETH holdings on Arbitrum.

DeFi Sector Coordinated Around Containment Efforts

The April exploit triggered wider systemic concerns after the attacker used stolen rsETH as collateral on Aave to borrow wrapped ether, creating approximately $190 million in bad debt exposure for the lending protocol.

The attacker has been widely linked to Lazarus Group, although legal proceedings tied to frozen funds remain ongoing.

In response to the exploit, Aave coordinated an industry-backed restitution initiative called “DeFi United,” which reportedly secured more than $300 million in ETH to stabilize the ecosystem and reduce contagion risks across DeFi markets.

Separately, the Arbitrum DAO previously froze approximately $72 million in ETH linked to the exploit through its Security Council mechanisms.

However, the transfer of those assets became subject to legal disputes after plaintiffs tied to prior terrorism-related judgments against North Korea sought claims over the frozen funds.

A federal court later allowed the transfer of ETH to Aave’s recovery structure while restricting further movement or liquidation of the funds pending additional approval.

LayerZero Acknowledges Configuration Failures

Following public disputes over responsibility for the exploit, LayerZero recently acknowledged shortcomings in its bridging configuration model.

The interoperability protocol initially argued that Kelp DAO used a high-risk “1-of-1” decentralized verifier network (DVN) setup against recommendations. Kelp DAO, however, stated that the configuration reflected default implementation settings for LayerZero-powered applications.

LayerZero later admitted that allowing 1-of-1 DVN configurations for high-value transfers created unintended security risks.

The incident has intensified broader industry scrutiny around cross-chain infrastructure security, validator design, and operational risk management within decentralized finance systems.