The Decentralized Finance (DeFi) sector is rebounding after one of the most high-profile incidents of the year. The Kelp and Aave protocols have officially entered the asset recovery phase following the April exploit, which resulted in a record-breaking loss estimated at $292 million.
The Recovery Plan: 117,132 rsETH in Two Weeks
Kelp developers have presented a detailed restoration timeline. The primary goal is to return 117,132 rsETH to users. The process is divided into several stages:
- Mainnet Transfer: The first batch of funds will be moved to the mainnet in the near future.
- Withdrawal Reopening: Kelp plans to enable asset withdrawals within 24 hours of the funds’ arrival.
- Resumption of Operations: Standard features—deposits, minting, and cross-chain transfers—will once again be available to users.
Radical Security Overhaul
The vulnerability exploited by the hackers (suspected to be the North Korean Lazarus Group) has forced the Kelp team to completely rethink its security architecture, particularly regarding bridge interactions.
- LayerZero Upgrade: Instead of a single validation node, a consensus of four independent nodes is now required.
- Increased Block Depth: The number of blocks required for transaction finalization has been increased from 42 to 64.
- Technology Shift: The protocol has begun migrating to Chainlink’s CCIP (Cross-Chain Interoperability Protocol), which is considered more secure for high-volume liquidity.
Admission of Liability: The LayerZero team confirmed that “default” security settings were not stringent enough for protocols of this scale, which created a window of opportunity for the attackers.
The Role of Aave and Legal Nuances
The Aave protocol played a key role in mitigating the fallout. In May, the hacker’s remaining rsETH positions were liquidated. Recently, project representatives confirmed the start of payouts and executed a burn of rsETH tokens held by the attacker on the Arbitrum network.
However, the process has been complicated by a legal precedent. A portion of the funds was frozen due to lawsuits filed by victims of terrorism against the DPRK.
- Current Status: The court allowed the assets to be transferred to the protocol to facilitate payouts but imposed a temporary ban on their sale until a final verdict is reached.
Results and Community Support
As Kelp restores its infrastructure, the Arbitrum community has also contributed to stabilizing the situation. A majority vote approved the transfer of 30,765 ETH (approximately $70 million) to the DeFi United fund to strengthen the ecosystem following the largest hack of 2026.
Despite the severe consequences of the attack, coordinated efforts by developers and legal victories provide hope that most affected users will be able to recover their funds in full by the end of the month.
