Kelp DAO, Aave to resume rsETH operations as recovery from $292 million exploit progresses

Kelp DAO and Aave are set to resume rsETH operations in the coming days, marking progress in the recovery from a $292 million exploit that occurred last month. Kelp announced that the stolen 117,132 rsETH will be refilled from Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter over the next two weeks. Withdrawals are expected to be unpaused within 24 hours after the first tranche is refilled, with all rsETH operations to resume normally thereafter. Kelp has also completed a security update for its LayerZero bridging configurations and is migrating to Chainlink's CCIP. Aave confirmed the completion of initial recovery steps, including burning the exploiter's rsETH on Arbitrum. The April 18 attack, attributed to North Korea's Lazarus Group, resulted in significant bad debt for Aave. An industry-wide restitution initiative, DeFi United, was launched, raising over $300 million. Efforts to recover funds faced legal challenges, including a restraining order from terrorism creditors, which Aave successfully challenged in court to allow the transfer of frozen ETH. LayerZero has issued an apology for its role, admitting fault in allowing insecure DVN configurations.

(Source：The Block)