Aave transferred the first 25,000 rsETH into the LayerZero OFT adapter on Ethereum mainnet on May 13, formally reopening cross-chain bridging for the liquid restaking token after the April 18 exploit. Both Aave and Kelp DAO confirmed the move on X. The transaction landed at block 25087631 with a fee of 0.00004376 ETH, per Etherscan . The first tranche of rsETH has been transferred into the LayerZero OFT adapter, and rsETH bridging between mainnet and L2s is back open. https://t.co/lYUPFv9T7Y — Aave (@aave) May 13, 2026 The transfer marks the operational restart of rsETH movement between Ethereum mainnet and Layer 2 networks for the first time since the LayerZero bridge exploit drained $292 million in unbacked tokens. What happens in the next 24 to 48 hours Kelp said rsETH contracts will unpause for withdrawals within 24 hours of the first tranche reaching the mainnet adapter. Deposits will reopen and exchange rates will update within 48 hours, with staking rewards accrued during the pause period credited to all rsETH holders. Remaining tranches from Aave’s Recovery Guardian and Kelp’s recovery safe will flow into the lockbox over the next two weeks, totaling 117,132 rsETH worth roughly $278 million at current prices. As Cryptopolitan reported on May 12, the first phase of the technical recovery involved burning the exploiter’s rsETH on Arbitrum. The May 13 transfer executes the second phase: refilling the bridge lockbox so cross-chain rsETH circulation can resume, backed by legitimate collateral. How the security architecture changed The reopened bridge runs on a hardened security model. Kelp completed a security pass audited by BailSec that raised the LayerZero verification requirement from a single attestor to four independent attestors and lifted block confirmation thresholds from 42 to 64. All L2-to-L2 bridging routes were deprecated. Kelp is also migrating its cross-chain infrastructure from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol. The technical post-mortem from Chainalysis attributes the April 18 exploit to a remote procedure call poisoning attack by North Korea’s Lazarus Group, specifically subunit TraderTraitor. The attackers compromised downstream RPC nodes that LayerZero verifiers relied on for Unichain L2 observation, feeding forged data that tricked the single-verifier bridge into releasing 116,500 rsETH on Ethereum mainnet without a legitimate source-side burn. What the recovery timeline says, and what Kelp still has to prove The exploit-to-restoration window now sits at 26 days. That compares against Ronin Bridge, where compensation took months and required outside funding, and Euler Finance, where recovery depended on attacker negotiation. The rsETH recovery proceeded without either: coordinated ecosystem funding through DeFi United, an on-chain burn of attacker collateral, and a federal court order from Judge Margaret Garnett clearing the 30,765 ETH transfer to Aave. But the damage extends beyond technical recovery. Kelp’s total value locked has fallen from roughly $2 billion in September 2025 to about $1.55 billion, reflecting the exploit and the extended operational pause. Competing liquid restaking protocols, including Ether.fi and Renzo, are watching whether liquidity returns to Kelp once contracts fully unpause, or whether users migrate elsewhere. The 30,765 ETH worth roughly $72 million recovered from the attacker remains in an Aave-controlled wallet pending further court authorization on the terrorism-creditor restraining notice filed May 1. The remaining 92,132 rsETH will be replenished to the LayerZero adapter in staged tranches over the next two weeks before normal operations fully resume. The smartest crypto minds already read our newsletter. Want in? Join them .
