Kelp DAO Moves rsETH to Chainlink CCIP Amid LayerZero Security Dispute

Kelp DAO is an Ethereum liquid-restaking protocol that issues tradable rsETH when users deposit ETH and uses the LayerZero bridge to deploy the token across more than 20 chains. The incident exposed concentration risks in a single verification network and in cross-chain infrastructure. It also disrupted lending markets including Aave, SparkLend and Fluid, and became the largest DeFi hack of 2026 to date.

On April 18, 2026, the attacker used forged cross-chain messages to withdraw 116,500 rsETH, then worth about $292 million and representing roughly 18% of the circulating supply. Kelp DAO said on May 26 that rsETH had been restored. By June 1, however, nearly all of the roughly $220 million in unfrozen stolen funds had been laundered, leaving only about $1.7 million in the originally flagged wallets. Another $71 million had been frozen.

Kelp DAO is an Ethereum liquid restaking protocol whose rsETH token supports cross-chain deployment, redemptions and reward accrual. Around mid-June 2026, hackers from North Korea’s Lazarus Group stole $293 million in assets, creating a collateral shortfall and disrupting liquidity on Aave. The incident highlighted the systemic risks arising from interdependencies among DeFi protocols.

Kelp DAO said in July 2026 that it had completed a five-week recovery plan, fully restoring rsETH’s cross-chain functionality, redemptions and reward mechanism. A coalition of protocols called “DeFi United” jointly injected funds to cover the $293 million shortfall caused by the attack while easing liquidity pressure on Aave.