Kelp DAO Completes Recovery of Restaked Ether Token Following Major Hack

Kelp DAO, an Ethereum liquid staking protocol, says its restaked Ether token has been restored after a five-week effort, after the protocol suffered a $293 million (roughly Rs. 2,804 crore) exploit led by North Korea's Lazarus Group on April 18. Kelp DAO further announced that the final segment of 20,373.7 Kelp DAO resteked ETH (rsETH) tokens were sent to the LayerZero smart contracts, which were responsible for locking, minting, burning, and releasing rsETH during cross-chain transfers. Several crypto protocols have contributed funds to assist in restoring rsETH's backing under the DeFi United initiative. 

DeFi Protocols Unite to Rebuild rsETH Backing After Major Hack

The Kelp DAO hack in April had caused a snowball effect throughout the crypto lending market that disrupted billions of dollars in liquidity and brought out more concerns about the connectivity of DeFi protocols. Aave was among the biggest victims after the Kelp DAO attacker used a large chunk of the stolen 116,500 rsETH as collateral on its lending platform to borrow wrapped Ether, leaving $190 million (roughly Rs. 1,818 crore) in bad debt and triggering a wave of withdrawals. As per the data by DeFiLlama, April witnessed 25 crypto hacks, with a combined total of $630 million (roughly Rs. 6,028 crore) worth of losses, the worst month since February 2025, when crypto exchange Bybit was hacked for a record $1.5 billion (roughly Rs. 14,352 crore). 

Later in April, DeFi protocols came together in an attempt to restore the backing of rsETH. The Decentralised platform Aave had called this effort “DeFI United”. Crypto protocols involved also include Mantle, EtherFi Foundation, Golem Foundation, Lido DAO, Ethena, LayerZero, Ink Foundation, and Tyrdo. The amount pledged by these DeFi protocols had accumulated 43,500 Ether at the time. 
  
The very next month, DeFi Protocol Kelp DAO announced that it would be migrating its staking token, rsETH, to the Chainlink oracle platform. The protocol had placed the blame for the attack on LayerZero's cross-chain infrastructure. While LayerZero argued that the hack occurred because of an inadequate setup tied to Kelp's decentralised verifier network (DVN), which relied on a single LayerZero DVN as the only verified path, rather than requiring multiple checks of cross-chain transactions. LayerZero had advised against such a setup. 

Earlier this month, the first tranche of 25,000 rsETH was transferred, allowing rsETH bridging between the Ethereum mainnet and the blockchain's layer 2 networks to reopen. After this, Kelp reopened withdrawals for rsETH and said on Tuesday that rsETH mints, redemptions, and rewards operations “have been running normally”.