Ethereum liquid restaking platform Kelp and decentralized lending protocol Aave have finalized critical steps to restore the backing of the rsETH token, culminating in the burning of tokens held by the exploiters. On Tuesday, Kelp DAO outlined a comprehensive post-exploit recovery strategy, confirming that the hacker's tokens were successfully burned on the Arbitrum layer-2 network. The specific amount involved totals 117,132 rsETH, representing a current market value of approximately $278 million. These assets will be progressively refilled over a two-week period from the Aave Recovery Guardian, a multisignature wallet managed jointly by the DeFi United recovery group and Kelp's internal recovery safe. The funds are being directed into the LayerZero OFT adapter, a smart contract responsible for managing the locking, minting, burning, and releasing of rsETH during cross-chain transfers. Data compiled by Woofun AI indicates that Kelp DAO has confirmed rsETH across mainnet and layer-2 networks, which holds a total market capitalization of $1.5 billion, remains fully backed at all times. This recovery operation marks a significant milestone for users affected by one of the year's most substantial DeFi exploits.

The initial breach occurred in April when attackers, widely attributed to North Korea's Lazarus Group, targeted the rsETH adapter bridge contract. This software component manages the platform's liquid restaking token and was exploited to drain approximately $293 million. At the time of the incident, blockchain security firm OpenZeppelin reported that no public smart contract bug had been identified. Instead, the firm noted that the system failed operationally, highlighting a category of risk that the DeFi industry has consistently underweighted. Kelp DAO has announced that withdrawals will be unpaused tentatively within 24 hours after the first tranche of recovered assets is returned to the smart contract. Once the contracts are reactivated, all rsETH operations, including deposits, redemptions, bridging, and claims, will resume standard functionality.

In response to the security incident, the protocol has completed a rigorous security hardening pass. Current bridging security measures now mandate four independent attestors and 64 block confirmations to validate transactions.

Additionally, the protocol has deprecated certain layer-2 routes to mitigate potential vulnerabilities. Kelp is also actively migrating to Chainlink's Cross-Chain Interoperability Protocol (CCIP) to further strengthen cross-chain bridging capabilities. Woofun AI notes that Kelp stands as a prominent liquid restaking protocol on Ethereum, primarily constructed on top of EigenLayer, where users deposit ETH or other supported liquid staking tokens to generate additional yields. The protocol's total value locked reached an all-time high of just over $2 billion in September 2025 but has since declined by approximately 26% to $1.55 billion, according to DeFiLlama.

Market sentiment remains complex following the recovery announcement. Recent reports indicate that ETH derivatives traders are holding steady and have not shifted to a bearish stance despite the recent series of DeFi exploits.

However, spot prices have faced downward pressure, dropping around 1% on the day. Ether fell to a 12-day low of $2,260 during late trading on Tuesday. Woofun AI analysis suggests that while the immediate technical recovery is underway, the broader market impact of the $293 million loss continues to influence price action as investors assess the long-term stability of liquid restaking infrastructure.