The numbers on May 15 told a cleaner story than any official announcement could. rsETH was moving off exchanges, and doing it fast.
On-chain data tracked by Santiment recorded a net outflow of approximately 435 rsETH from exchanges on May 15, the same day Kelp DAO confirmed that withdrawals, bridging, and protocol operations had fully resumed after a weeks-long freeze. The timing was not coincidental.
The Mirror Nobody Talked About
Go back to April 18. The day Kelp DAO suffered what is now confirmed as the largest DeFi security breach of 2026, Santiment’s exchange flow data captured a net inflow of roughly 563 rsETH rushing onto exchanges within hours of the attack becoming public. Users were scared. Moving assets to exchanges is the fastest way to sell, swap into stablecoins, or just get out before conditions got worse.
That reaction made sense. A forged cross-chain message on Kelp’s LayerZero-powered bridge tricked the system into releasing 116,500 rsETH on Ethereum without a corresponding burn on the source chain. North Korea’s Lazarus Group was identified as the attacker. The stolen rsETH was then deposited as collateral on Aave to borrow WETH, generating close to $190 million in bad debt and triggering market freezes across multiple chains.
[sourced from SantimentData post on X, showing April 18 inflow spike at +563 rsETH and May 15 outflow dip at -435 rsETH]
The chart from Santiment shows both events side by side. A sharp orange spike upward on April 18, then a sharp move in the opposite direction nearly four weeks later. According to SantimentData on X, the May 15 outflow marked Kelp DAO’s largest single-day exchange outflow in three months.
“On May 15th, our data has recorded a net outflow of approximately -435 rsETH from exchanges shortly after Kelp DAO announced that rsETH withdrawals, bridging, and protocol operations have fully resumed.” — SantimentData on X
Users pulling rsETH back off exchanges signals a shift in posture. They are moving assets into self-custody wallets, back into staking positions, and back into DeFi applications. That behavior does not happen when confidence is shaky.
What Actually Changed on May 15
Kelp DAO’s restart was not a soft reopen. Aave confirmed that rsETH markets had been unpaused across five networks, including Ethereum Core, Arbitrum, Base, Linea, and Mantle. Withdrawals went live. Bridging resumed. EigenLayer claims became active. Exchange rates were updated at 4:30 PM CET on May 15 to reflect staking rewards accrued during the pause period, rewards that rsETH holders had earned but could not access for nearly a month.
The recovery was built on a coordinated effort called DeFi United, which raised more than $300 million in ETH commitments from protocols including Lido and Ether.fi, along with individual contributors. Kelp and Aave progressively refilled 117,132 rsETH, the exact amount stolen, into the LayerZero OFT adapter on Ethereum mainnet over two weeks using the Aave Recovery Guardian multisignature wallet and the Kelp Recovery Safe. The exploiter’s rsETH holdings on Arbitrum were burned to prevent stolen tokens from re-entering circulation.
A Bridge That No Longer Exists
Kelp’s security upgrade goes further than the immediate fix. The protocol completed what it described as a security hardening pass across all LayerZero bridging configurations, raising block confirmations from 42 to 64, requiring four independent attestors instead of one, and deprecating all L2-to-L2 routes that previously allowed the attack vector to exist.
It is also migrating rsETH’s cross-chain infrastructure from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol. Chainlink CCIP uses at least 16 independent node operators to validate cross-chain transactions. The 1-of-1 DVN setup that enabled the April 18 attack will not exist in the new architecture. Kelp DAO’s GitHub repository already lists a CCIP-based rsETH contract alongside the legacy LayerZero contract, with the migration underway.
LayerZero itself issued a public apology after initially blaming Kelp DAO for using a single-verifier setup, before later acknowledging that its system had allowed such configurations for high-value transactions without adequate safeguards.
The protocol’s total value locked hit an all-time high above $2 billion in September 2025, per DeFiLlama, and has since dropped roughly 26% to around $1.55 billion. Whether the May 15 outflow from exchanges marks the start of a genuine TVL recovery or simply reflects short-term relief remains to be seen. Deposits are still paused pending a stabilization window before Kelp fully reopens that side of the protocol.
For an rsETH holder watching the Santiment chart, the -435 outflow is not just a number. It is 435 rsETH worth of users who decided Kelp DAO was worth trusting again, at least enough to move assets back off an exchange. You can track rsETH exchange flow balance in real time here.
