Key Highlights
- The Kelp DAO exploiter’s rsETH collateral across Ethereum and Arbitrum has been liquidated by Aave
- Liquidated assets were transferred to Recovery Guardian, a multisig controlled by DeFi United
- The recovery initiative is approximately 10% away from securing sufficient ETH to fully back rsETH
- Legal complications have frozen 30,765 ETH approved by Arbitrum DAO following a restraining notice from a US legal firm
- Aave’s TVL has bounced back from $14.2B to surpass $15B once again
The lending protocol Aave has successfully liquidated all remaining rsETH collateral positions connected to the Kelp DAO exploiter across both the Ethereum mainnet and Arbitrum network. This action represents a significant milestone in the DeFi United community-led initiative aimed at restoring rsETH’s proper backing and compensating affected users.
All liquidated assets have been routed to the Recovery Guardian wallet, a multisignature address under DeFi United’s control. Aave emphasized that the liquidation process did not impact any user deposits and was completed without activating its Umbrella insurance protection.
The exploitation occurred on April 18 when an attacker—believed to have connections to North Korean threat actors—exploited vulnerabilities in Kelp DAO’s LayerZero-based bridge infrastructure. This allowed the malicious actor to illegitimately create 116,500 rsETH tokens on Ethereum without proper backing. These fraudulent tokens were subsequently deployed as collateral on decentralized lending protocols like Aave and Compound to extract wrapped Ether.
The security breach saddled Aave with over $190 million in uncollateralized debt and sparked significant capital flight from the platform. In the seven days after the incident, the protocol witnessed its total value locked plummet by approximately $12 billion.
To enable the liquidations, Aave’s governance community approved a temporary modification to the rsETH price oracle. This adjustment created an undercollateralized state in the attacker’s borrowed positions, triggering the liquidation mechanism. The oracle configuration has since returned to standard operating parameters.
DeFi United’s recovery fund has accumulated more than $320 million in contributions. Galaxy Digital’s vice president of research, Thaddeus Pinakiewicz, indicated that the fund requires approximately 10% additional ETH to completely resolve the backing deficit.
Legal Battle Complicates Recovery
A separate complication has emerged that threatens to delay the recovery timeline. Following Arbitrum DAO’s decision to freeze 30,765 ETH linked to the attack for transfer to DeFi United, Gerstein Harrow LLP—a United States law firm—submitted a restraining notice last Friday aimed at preventing the transfer.
The legal firm seeks to claim the frozen Ethereum as restitution connected to terrorism-related court judgments against North Korea. Aave has responded by filing an emergency motion requesting the court to dismiss the restraining notice.
Arbitrum DAO token holders continue to deliberate on whether to authorize the release of these funds to DeFi United, with more than 90% of voting participants supporting the transfer. The governance vote is set to conclude this Friday.
Waiting on Stablecoin Commitments
DeFi United remains in discussions with several major crypto entities awaiting formal pledges. These include stablecoin issuers Circle, Ethena, and Frax, as well as Ink, the Ethereum layer-2 network developed by Kraken.
Pinakiewicz said these commitments are needed to “get it over the line and plug the hole.”
Aave’s total value locked has demonstrated signs of recovery. According to DefiLlama analytics, the protocol has rebounded from its April 26 low of $14.2 billion to exceed $15 billion in recent trading sessions.
Outflows from Aave’s lending markets have moderated during the past week. Friday’s conclusion of the Arbitrum DAO governance vote will serve as a critical juncture in determining whether the restoration initiative can achieve its objectives.
