Aave and Kelp DAO have completed the final stage of their recovery plan tied to the April 18 rsETH exploit, restoring normal operations across DeFi after weeks of disruption. The final 20,373.72 rsETH was moved into LayerZero infrastructure, enabling bridging, withdrawals, minting, and rewards to resume across supported networks.
Aave confirmed on X that all rsETH markets were operating normally again, while Kelp DAO said the recovery effort had officially concluded following weeks of liquidity repairs after the cross-chain attack.
Recovery effort restores rsETH operations
The recovery effort followed an April 18 hack that drained funds worth nearly $293 million and triggered one of the biggest shocks in decentralized finance this year. Investigators linked the attack to North Korea’s Lazarus Group after hackers used manipulated cross-chain transactions to steal funds and leave nearly $190 million in bad debt on Aave.
The fallout spread quickly across crypto lending markets. Several platforms froze activity to limit further losses, while users pulled billions of dollars from decentralized finance protocols. DeFiLIama data showed that Aave’s total value locked (TVL) fell from more than $26 billion to below $14 billion within weeks as confidence across the sector weakened.
In response, major crypto projects including Lido Finance, Ether.fi, LayerZero, and Mantle joined a coordinated recovery initiative known as DeFi United. The group secured more than $300 million in ETH support to help restore rsETH reserves and stabilize affected markets.
Kelp DAO said about 116,000 rsETH had been returned during the past two weeks as the recovery process neared completion.
Legal pressure and infrastructure changes continue
Even as operations return to normal, legal and security concerns tied to the hack are still unfolding. A federal judge in New York delayed a decision over 30,765 Ether frozen by Arbitrum’s Security Council, asking both sides to provide more legal arguments ahead of a June 5 hearing.
At the same time, Kelp DAO said it is moving parts of its infrastructure away from LayerZero and toward Chainlink’s CCIP system after the exploit raised concerns about how cross-chain transactions were verified.
The $293 million attack now stands as one of the biggest decentralized finance hacks of 2026. The breach also exposed broader weaknesses in crypto bridge security and showed how problems in one protocol can quickly spread across interconnected DeFi platforms.
Also Read: Fake Google Ads Target Uniswap Users in $400K Crypto Scam
