What happened to Kelp DAO’s rsETH token?

Kelp DAO said it completed the operational recovery of its rsETH token after a $293 million exploit linked to Lazarus Group disrupted the protocol and broader DeFi markets.

How did the Kelp DAO exploit affect DeFi markets?

The attacker reportedly used around 116,500 rsETH as collateral on Aave to borrow wrapped Ether. That triggered roughly $190 million in bad debt and accelerated major liquidity withdrawals across decentralised finance platforms.

rsETH is a restaked Ether token connected to Ethereum liquid staking and cross-chain DeFi activity. Users can use rsETH across lending, bridging and yield-generating protocols while retaining Ethereum staking exposure.

Who was linked to the Kelp DAO exploit?

The exploit was attributed to the Lazarus Group, a North Korea-linked hacking organisation frequently accused of targeting crypto protocols and exchanges to generate funds through cybercrime operations.

How did Kelp DAO restore rsETH backing?

Kelp DAO said several DeFi projects contributed support through a coordinated “DeFi United” recovery initiative. The protocol gradually restored rsETH reserves and reopened key operations during the five-week recovery process.

What role did LayerZero play in the recovery?

Kelp DAO transferred the final tranche of rsETH tokens to a LayerZero smart contract responsible for managing minting, burning and cross-chain bridging functions for the token ecosystem.

Has Kelp DAO fully resumed operations?

Yes. Kelp DAO said rsETH minting, withdrawals, redemptions and rewards operations have been functioning normally since reopening earlier this month.

Why was Aave heavily impacted by the exploit?

Because the attacker used large amounts of rsETH as collateral on Aave, the exploit created significant lending market exposure when liquidity conditions deteriorated. That contributed to major losses and user withdrawals.

Image for illustrative purposes only. Not a real photo.

Kelp DAO completes rsETH recovery after Lazarus hack

Written by Heidi Cuthbert Published May. 26 2026Last Updated May. 26 2026

Kelp DAO said it completed the operational recovery of its rsETH token roughly five weeks after suffering a $293 million exploit attributed to North Korea-linked hacking group Lazarus Group.

Kelp DAO said the final tranche of 20,373.7 rsETH tokens was transferred to the LayerZero smart contract responsible for managing cross-chain minting, burning and bridging functions for the token.

“This closes the operational part of the rsETH recovery plan,”

Kelp DAO said in a statement posted on X.

The exploit triggered major disruption across decentralised finance markets after the attacker used approximately 116,500 rsETH as collateral on Aave to borrow wrapped Ether, contributing to roughly $190 million in bad debt.

The incident also accelerated large liquidity withdrawals from Aave and broader DeFi lending markets, highlighting ongoing concerns around systemic risk and protocol interconnectedness within decentralised finance ecosystems.

Kelp DAO said several DeFi protocols contributed funds through a coordinated “DeFi United” recovery initiative aimed at restoring full backing for rsETH.

The protocol reopened rsETH withdrawals earlier this month after transferring an initial 25,000 rsETH tranche on May 13, while saying minting, redemption and rewards systems have since operated normally.

According to DefiLlama data, Aave’s total value locked fell from about $26.4 billion to below $14 billion following the exploit and has yet to meaningfully recover despite outflows stabilising in recent weeks.

At the time of reporting, Ethereum price was $2,084.73.