Kelp DAO and Aave have completed a critical step in recovering from one of 2025's largest DeFi exploits, confirming that the hacker's 117,132 rsETH tokens — currently worth approximately $278 million — have been burned on Arbitrum. The tokens will be progressively refilled over two weeks from the Aave Recovery Guardian multisignature wallet, controlled by the DeFi United recovery group and Kelp's own recovery safe, into the LayerZero OFT adapter that handles rsETH during cross-chain transfers. Kelp confirmed that rsETH across mainnet and layer-2 networks, which carries a total market capitalization of $1.5 billion, remains fully backed at all times throughout the recovery process. Withdrawals are expected to resume within 24 hours of the first tranche being returned to the smart contract, after which deposits, redemptions, bridging, and claims will all come back online as normal.The April exploit, widely attributed to North Korea's Lazarus Group, drained approximately $293 million by targeting Kelp's rsETH adapter bridge contract. Blockchain security firm OpenZeppelin noted at the time that no smart contract bug had been publicly identified and that "the system failed operationally" — a category of risk the DeFi industry has "consistently underweighted.

Kelp's post-recovery security hardening reflects that lesson: cross-chain bridging now requires four independent attestors and 64 block confirmations, some layer-2 routes have been deprecated, and the protocol is migrating to Chainlink's Cross-Chain Interoperability Protocol for further strengthened cross-chain infrastructure. The protocol's TVL has declined approximately 26% from its September 2025 all-time high of $2 billion to $1.55 billion, though ETH derivatives traders have remained steady despite the broader wave of DeFi exploits in recent weeks.