Kelp DAO Restores rsETH 5 Weeks After $293M Exploit

Kelp DAO completed a five-week recovery effort following a $293 million exploit attributed to North Korea's Lazarus Group on April 18. The protocol restored its restaked Ether token with support from multiple crypto protocols under the DeFi United initiative.

What Happened

Ethereum liquid staking protocol Kelp DAO announced on May 26, 2024, that it has fully restored its restaked Ether token (rsETH) after suffering a $293 million exploit on April 18. The hack, attributed to North Korea's Lazarus Group, forced the protocol into a comprehensive recovery operation spanning five weeks.

On Monday, May 26, Kelp DAO posted to X that the final tranche of 20,373.7 rsETH tokens was sent to the LayerZero smart contract responsible for locking, minting, burning, and releasing rsETH during cross-chain transfers. According to Kelp DAO's statement, this final transaction closed the operational portion of the rsETH recovery plan.

The protocol opened withdrawals for rsETH earlier in May and has reported that mints, redemptions, and rewards operations have since been running smoothly. Multiple crypto protocols contributed funds to help restore rsETH's backing under the collaborative DeFi United initiative, which coordinated the recovery response.

Why It Matters

The Kelp DAO hack represented one of the largest protocol exploits in 2024 and tested the resilience of the broader DeFi ecosystem's cross-chain infrastructure. The successful recovery of rsETH demonstrates that even major security breaches can be addressed through coordinated industry response, though the five-week timeline highlighted operational challenges in fund recovery and token restoration at scale.

The incident affected users holding rsETH and exposed risks in liquid staking protocols that operate across multiple blockchain networks. The recovery's success under DeFi United suggests emerging best practices for crisis management, though it also underscores the persistent security vulnerabilities in protocols handling billions in user assets. For investors and users, the restoration signals that Kelp DAO's operational infrastructure has resumed normal function, though questions about the original security failure remain relevant for risk assessment.

Expert Perspective

The Lazarus Group attribution added geopolitical dimensions to what would have otherwise been a technical security incident. The group's known history of targeting cryptocurrency protocols and exchanges made this exploit consistent with established patterns, though it marked one of the largest single-protocol breaches attributed to the North Korean-linked threat actor.

Comparable recovery efforts in DeFi history, such as the Poly Network's $611 million theft in 2021, typically required longer timelines or involved different recovery mechanisms. Kelp DAO's five-week restoration under DeFi United coordination represents a relatively expedited response, suggesting improved industry processes for handling protocol exploits, though the ability to recover quickly depends heavily on protocol design, liquidity availability, and stakeholder cooperation.

What to Watch

Investors should monitor Kelp DAO's protocol governance responses regarding the April 18 exploit, including any proposed security audits, smart contract upgrades, or enhanced monitoring systems. Watch for updates on total value locked (TVL) recovery in rsETH and whether the token regains its pre-hack market positioning. Track whether the DeFi United initiative evolves into a formalized crisis response framework for future protocol exploits, and observe if other liquid staking protocols implement additional security measures influenced by Kelp DAO's experience.

Not financial advice.