Kelp DAO Burns Hacker's rsETH, Plans Withdrawal Reopening

Kelp DAO, an Ethereum liquid restaking platform, announced completion of critical recovery measures following an exploit that threatened its rsETH token backing. The protocol and Aave confirmed that 117,132 rsETH tokens—valued at approximately $278 million at current market prices—held by the attacker have been permanently burned on the Arbitrum layer-2 network.

The exploit exposed vulnerabilities in cross-chain asset management, impacting confidence in [INTERNAL: liquid staking derivatives] protocols. Kelp outlined a two-week restoration plan to progressively refill rsETH reserves through funds controlled by the Aave Recovery Guardian multisignature wallet, a collaborative recovery framework managed by DeFi United and Kelp's own recovery safe.

Funds will be transferred via the LayerZero OFT adapter, the smart contract infrastructure responsible for locking, minting, burning, and releasing rsETH during cross-chain transactions. This mechanism is critical to maintaining token parity across networks.

The recovery approach demonstrates how major DeFi platforms coordinate response efforts. By leveraging Aave's established governance infrastructure, Kelp accelerated restoration without requiring emergency protocol shutdowns. The timeline provides clarity for affected users and liquidity providers.

Withdrawal functionality remains paused during the recovery period. Users cannot exit positions until liquidity sufficiently rebuilds. Protocol developers emphasized that burning attacker-controlled tokens reduces total rsETH supply, effectively diluting the damage across remaining token holders proportionally.

The exploit highlights ongoing risks in [INTERNAL: cross-chain bridges] and adapter protocols. LayerZero's role in the incident sparked broader discussions about multi-chain asset security standards.

Kelp operates as a node operator platform for Ethereum restaking, allowing users to earn yields on staked ETH. The platform had previously attracted significant capital before the security incident.

Recovery completion depends on consistent funding flows and market conditions. Protocol teams continue monitoring the restoration schedule and may adjust timelines based on liquidity conditions.

This is not financial advice. Users should conduct independent research before interacting with recovered protocols.