Ethereum-based liquid restaking protocol Kelp and decentralized lending platform Aave have completed a comprehensive recovery operation to fully restore the security of their rsETH tokens following a major cyber attack in recent months. While it is emphasized that rsETH, which currently has a market value of 1.5 billion dollars, currently remains fully collateralized in all networks, a total of 117,132 rsETH (worth approximately 278 million dollars) will be gradually transferred back into the system within two weeks.
Recovery Steps and Burning Process
In the statement made by Kelp DAO, it was reported that after the attack last April, rsETH tokens determined to belong to the cyber hacker were irreversibly burned in the Arbitrum network. This process aims to completely reset the attacker’s impact on the ecosystem and eliminate the loss of trust.
After the burning process, a total of 117,132 rsETH will be transferred from the multi-signature wallet under the control of Aave Recovery Guardian and Kelp’s own security wallet to replace the burned amount of rsETH. This process, which will be carried out through smart contracts, will be completed in approximately two weeks.
Kelp DAO officials stated that the market value of rsETH tokens traded on the mainnet and all layer-2 networks is at the level of 1.5 billion dollars and that all tokens are fully equivalent at any time.
Attack History and Security Measures
The Kelp platform was subject to a major attack in April, attributed to the North Korea-linked Lazarus Group. In the attack in question, a fund worth $293 million was withdrawn from the system through the rsETH adapter bridge contract. OpenZeppelin, one of the well-known companies in blockchain security, stated in the report it prepared after the attack that no significant smart contract vulnerability was detected, but systemic operations were inadequate.
After this great loss, Kelp DAO went through a comprehensive “security strengthening” process. Bridge transactions now require four independent validators and 64 block confirmations; It is noteworthy that some layer-2 transitions are disabled. Additionally, preparations have begun to migrate the bridge infrastructure to Chainlink’s cross-chain protocol.
Market Status of the Platform and New Era for Users
As of today, the total amount of assets locked on Kelp’s platform has decreased to $1.55 billion. According to DeFiLlama data, this value peaked at $2 billion in September 2025, but the attack and subsequent security concerns led to a decline in this level.
With this recovery operation, the aim is to ensure that users affected by the attack can access their assets again without any problems. Kelp executives stated that withdrawal transactions will be reactivated within 24 hours after the first transfer reaches the smart contract. Thus, it was announced that all rsETH transactions on the platform, including deposits, withdrawals, bridges and requests, will return to normal.
Kelp DAO stated, “With the completion of the first phase, withdrawals will temporarily reopen; thereafter, all rsETH operations will continue in the standard order.”
The platform is built on the EigenLayer infrastructure on the Ethereum network and promises users extra returns on ETH and other liquid staking tokens. Kelp is known for high liquidity, especially in the DeFi space.
In the light of recent developments, according to the data provided by Cointelegraph, investors making Ethereum derivative transactions have not generally moved to a pessimistic picture, despite these major attacks. However, the spot Ether price has retreated to $2,260, the lowest level of the last 12 days.
