{"id":97055,"date":"2026-05-13T11:29:25","date_gmt":"2026-05-13T08:29:25","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=97055"},"modified":"2026-05-13T11:30:13","modified_gmt":"2026-05-13T08:30:13","slug":"kelp-and-aave-begin-asset-recovery-after-hack","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/kelp-and-aave-begin-asset-recovery-after-hack\/","title":{"rendered":"Kelp and Aave Begin Asset Recovery After Hack"},"content":{"rendered":"<p>The protocols Kelp and <a href=\"https:\/\/forklog.com\/en\/news\/what-is-aave\">Aave<\/a> have commenced the recovery of assets following the April hack amounting to $292 million. Developers plan to return 117,132 rsETH within two weeks.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Kelp and Aave have successfully completed a series of steps for rsETH backing, including burning the exploiter\u2019s rsETH on Arbitrum.<\/p>\n<p>117,132 rsETH will be progressively refilled from Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on mainnet over the\u2026<\/p>\n<p>\u2014 Kelp (@KelpDAO) <a href=\"https:\/\/twitter.com\/KelpDAO\/status\/2054290142152831309?ref_src=twsrc%5Etfw\">May 12, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The first portion of funds will be transferred to the mainnet shortly. Following this, Kelp will reopen asset withdrawals\u2014expected within 24 hours. Users will once again have access to deposits, minting, and <a href=\"https:\/\/forklog.com\/en\/news\/what-are-cross-chain-bridges\">cross-chain<\/a> transfers.<\/p>\n<p>The Kelp team has updated the security settings of the LayerZero bridge. Now, four independent nodes are required to confirm transactions instead of one, and the number of necessary blocks has increased from 42 to 64. The protocol has also begun transitioning to <a href=\"https:\/\/forklog.com\/en\/news\/chainlink-to-open-access-to-the-cross-chain-interoperability-protocol\">Chainlink&#8217;s CCIP technology<\/a>.<\/p>\n<p>Representatives from Aave confirmed the commencement of payouts and burned the rsETH tokens held by the hacker on the <a href=\"https:\/\/forklog.com\/en\/news\/what-is-arbitrum\">Arbitrum<\/a> network.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">The first set of steps in the rsETH technical recovery plan are complete, including burning the exploiter&#8217;s rsETH on Arbitrum. Progressively refilling the LayerZero OFT adapter and reopening rsETH operations will follow over the coming days. <a href=\"https:\/\/t.co\/p1tiIzp5Nr\">https:\/\/t.co\/p1tiIzp5Nr<\/a><\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2054307857642971225?ref_src=twsrc%5Etfw\">May 12, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Previously, the lending protocol team <a href=\"https:\/\/forklog.com\/en\/news\/aave-seeks-court-order-to-release-30000-eth-seized-by-hackers\">challenged<\/a> in court the freezing of some funds imposed by lawsuits from terrorism victims against North Korea. The court allowed the transfer of assets to the protocol but prohibited their sale until a final decision is made.<\/p>\n<p>LayerZero developers <a href=\"https:\/\/forklog.com\/en\/news\/layerzero-admits-errors-following-292-million-kelp-hack\">admitted<\/a> fault in the incident. The company confirmed that the default security configuration was insufficiently protected for protocols with a large volume of locked funds.\u00a0<\/p>\n<p>In April, Kelp <a href=\"https:\/\/forklog.com\/en\/news\/kelp-protocol-loses-293-million-following-cross-chain-bridge-attack\">was attacked<\/a>, allegedly by the <a href=\"https:\/\/forklog.com\/en\/news\/lazarus-group-what-we-know-about-the-outfit-suspected-of-the-bybit-hack\">Lazarus Group<\/a>. This hack was the largest in the DeFi sector since the beginning of the year.<\/p>\n<p>In May, Aave <a href=\"https:\/\/forklog.com\/en\/news\/aave-liquidates-hacker-kelps-positions\">liquidated<\/a> the remaining positions of the Kelp hacker in rsETH as part of the <a href=\"https:\/\/forklog.com\/en\/news\/defi-united-initiative-raises-over-300-million-following-kelp-hack\">approved recovery plan<\/a>.\u00a0<\/p>\n<p>Later, the Arbitrum community <a href=\"https:\/\/forklog.com\/en\/news\/arbitrum-dao-approves-70-million-transfer-to-defi-united-fund\">supported<\/a> the transfer of 30,765 ETH worth $70 million to the DeFi United fund.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The protocols Kelp and Aave have commenced the recovery of assets following the April hack amounting to $292 million. Developers plan to return 117,132 rsETH within two weeks.<\/p>\n","protected":false},"author":1,"featured_media":97056,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Kelp and Aave start asset recovery after $292M hack, aiming to return 117,132 rsETH in two weeks.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1212,44,1111,1093,1349],"class_list":["post-97055","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-aave","tag-cybercrime","tag-cybersecurity","tag-defi","tag-layerzero"],"aioseo_notices":[],"amp_enabled":true,"views":"5","promo_type":"1","layout_type":"1","short_excerpt":"Kelp and Aave start asset recovery after $292M hack, aiming to return 117,132 rsETH in two weeks.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=97055"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97055\/revisions"}],"predecessor-version":[{"id":97057,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97055\/revisions\/97057"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/97056"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=97055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=97055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=97055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}