Kelp DAO announces full restoration of rsETH: North Korean hackers stole $293 million 5 weeks ago

Ethereum Liquid Staking Protocol Kelp DAO Completes a 5-Week Recovery Plan, rsETH Cross-Chain Liquidity, Redemption, and Reward Mechanisms Fully Restored. The recovery was facilitated by joint funding from multiple protocols.
(Previous context: 2026 Largest DeFi Incident: Kelp Theft of $292 Million, Aave Bad Debt Near $200 Million, rsETH Backing Collapse)
(Additional background: Aave’s Five Major Protocols Joint Proposal: Unfreeze 30k ETH on Arbitrum DAO, Inject into DeFi United to Restore rsETH Collateral)

Table of Contents

Toggle

• DeFi United: Five Major Protocols Joint Funding
• Impact of Aave Theft: TVL Halved
• Aave’s Liquidity Indicators

Ethereum Liquid Staking Protocol Kelp DAO completed a 5-week recovery effort last week, announcing that its rsETH staked Ethereum tokens are fully operational again. This recovery was a chain reaction stemming from the $293 million theft by North Korean Lazarus hackers on April 18.

Last Monday, Kelp DAO announced on X that the final 20,373.7 rsETH had been officially transferred into the LayerZero smart contract, which handles locking, minting, burning, and releasing rsETH during cross-chain transfers. This operation marked the official end of the rsETH recovery plan.

DeFi United: Five Major Protocols Joint Funding

This recovery was not achieved by Kelp DAO alone. Several crypto protocols contributed funds through the “DeFi United” initiative to collectively rebuild rsETH collateral. Kelp DAO stated that since restarting rsETH withdrawals earlier this month, core functions such as minting, redemption, and reward distribution have been operating smoothly.

Looking back at the timeline, the first 25,000 rsETH were transferred on May 13, when rsETH re-established cross-chain channels between the Ethereum mainnet and various Layer 2 networks. The following day, Kelp DAO officially re-enabled the withdrawal function.

Impact of Aave Theft: TVL Halved

The chain reaction caused by Kelp DAO’s theft was more severe than expected. Aave was one of the earliest protocols to feel the shockwave.

The hackers deposited the stolen 116.5k rsETH as collateral on Aave’s lending platform, borrowing Wrapped Ether, which resulted in $190 million in bad debt and triggered a wave of withdrawals. Aave’s total locked value plummeted from $26.4 billion to below $1.4 billion, losing its long-held position as the top DeFi protocol.

Aave’s Liquidity Indicators

Data from DefiLlama shows that net outflows from Aave’s lending markets have significantly slowed over the past month. However, Aave’s TVL has not shown clear signs of recovery, remaining between $13.9 billion and $15.1 billion about a week after the incident.

This event also highlights the interconnectedness of DeFi protocols. When liquidity staking, re-staking, and cross-chain bridges’ capital chains break, the impact quickly spreads to downstream lending markets. Although Kelp DAO’s recovery has concluded, rebuilding liquidity in the DeFi ecosystem still requires time.