Kelp DAO Begins Recovering rsETH After April Exploitation

Today, we are witnessing one of the most innovative developments in the history of the industry. Following a difficult month of debt cancellations and bad debt threats, Kelp DAO and Aave have signaled the end of the “rETH Crisis”.

By May 13, 2026, the recovery is at its peak. The “burning” on Arbitrum is over, the replenishment of 117,132 rETH has begun, and the security architecture of the famous liquid token (LRT) has been rebuilt from the ground up. This is not just a technical patch; is an expert group on environmental sustainability.

Anatomy of a “Phantom” Burn

To understand the recovery, we need to look back at the chaos of April 18, 2026. This was not a typical crisis of intellectual cooperation or a simple leak. According to aDeep analysis of death by ChainalysisKelp DAO was hit by a deadly RPC attack organized by North Korea’s Lazarus group.

The target was the LayerZero Omnichain Fungible Token (OFT) adapter. The attackers compromised the low-level RPCs that LayerZero’s verifiers relied on to check the “source” (in this case, Uniswap’s Unichain L2). By feeding fraudulent data to the single authentication configuration, the attackers tricked the bridge into believing that 116,500 rETH had been burned on Unichain, when in fact, the supply was still available. The bridge, by executing a “verified” message, released the equivalent of rsETH on the Ethereum mainnet directly under the hacker’s nose.

This was the “observation-layer” function. It revealed a major vulnerability in the DeFi infrastructure: even smart contracts are only as secure as the data they feed on. The fall was rapid. The rsETH has been stolen it was used as collateral for Aave v3 and Compound to borrow WETH, creating about $300 million in bad debt and causing the rETH peg to drop to $2,800 while ETH traded at $3,500.

Rebuilding 117,132 rETH Escrow

The changes shared by the Kelp DAO today indicate a shift from “damage control” to “recovery.” This recovery includes a highly integrated workflow between Aave Recovery Guardian and Kelp DAO Recovery Safe.

Over the next 14 days, a total of 117,132 rETH will be gradually loaded into the LayerZero OFT adapter on the Ethereum mainnet. This addition ensures that every rsETH token around the 20+ supported Layer 2s is backed 1:1 with real collateral in the mainnet escrow.

“rsETH on Mainnet and L2s remains fully supported at this time,” the team has confirmed.

Fortunately, the first step in this addition to the LayerZero OFT adapter is a “green light” for users. Kelp DAO aims to withdraw funds within 24 hours of the initial deposit. When the contracts are not suspended, all normal operations, including redemptions, claims, and foreclosures, will resume as usual. For thousands of users who have had their headquarters for weeks, this is the light at the end of the tunnel.

Breaking the Hacker’s Shadow

One of the most difficult parts of the restoration picture was dealing with rsETH is still held by the user on Arbitrum. Because the attacker put the stolen tokens as collateral, they had a “claim” on the system that threatened the integrity of the recovery.

Working together with the Arbitrum Security Council and the Aave administration, the recovery team was able to isolate and burn the rsETH stock on Arbitrum. This “surgical removal” of the illegal symbols was necessary for refilling. By burning the shadow of the hackers, the group ensured that the new ETH being injected into the system returned the valid tokens of the users, instead of giving the exit to the Lazarus Group.

Investigating “BailSec” and the Death of L2-to-L2 Networks

Kelp DAO doesn’t just fill boxes; he is building a fort. The protocol has recently completed a “hard security” certification audited by BailSec. The goal was to eliminate the “single point of failure” that allowed April’s operation to take place.

Important Additions:

• Quorum Expansion: Verification now requires 4 independent witnesses (DVNs), up from the 1-of-1 transition that previously relied on LayerZero Labs.

• ​Enhanced Endpoints: Blocking guarantees for cross-messages have been increased from 42 to 64. This greatly increases the cost and complexity of “chain-reorg” or “data-withholding” attacks.

• Channel Suspension: All L2-to-L2 communication channels are down. All bridge work must now go through the Ethereum L1 hub, ensuring that the “source of truth” is always the most secure chain in the universe.

This change to multi-source authentication is a direct response to the RPC execution method used by Lazarus. In seeking consensus from four different organizations, the Kelp DAO has proven that an attacker would need to disrupt the operations of several independent companies at the same time – which is much more difficult than attacking a single site.

Pivot to Chainlink CCIP

Perhaps the most important long-term option is the Kelp DAOleave LayerZero and go to Chainlink CCIP. The move reflects the growing conflict between Kelp and LayerZero over the April 18 incident.

While LayerZero claims that the action was caused by Kelp’s faulty “1-of-1 DVN” implementation, Kelp DAO claims that inconsistent updates and a lack of timely warnings were to blame. By choosing Chainlink’s Cross-Chain Interoperability Protocol (CCIP), Kelp DAO is choosing a model that requires cooperation from 16 independent parties.

The migration to the Chainlink Cross-Chain Token (CCT) standard is expected to be completed in the coming months. This change reflects what is happening in many companies in 2026: as the number of chains increases, “convenience” is being sacrificed for “guaranteed security.”

Kelp DAO Hack Shows DeFi Stands United

The recovery of Kelp DAO’s rsETH is a testament to the maturity of the financial system. A year ago, taking advantage of the $292 million would have caused a crash that destroyed the mortgage markets. In 2026, we saw Aave, Mantle, and DeFi United join within a few hours to create a “Recovery Guardian” partnership.

From Stani Kulechov’s pledge of 5,000 ETH to the Arbitrum vote that paved the way for the burn, recovery proves that “community” isn’t just a buzzword in DeFi — it’s a defensive unit.

As the withdrawals continue and rsETH services return to normal, the implications for the entire market are clear: Infrastructure is the new battlefield. In the era of Alpenglow and CCIP, the protocols that will survive will not be those that ignore danger, but those that create robust systems to recover from.