Key Highlights
- The lending protocol liquidated all remaining rsETH holdings belonging to the Kelp DAO exploiter across Ethereum and Arbitrum networks
- Liquidated assets were transferred to Recovery Guardian, a multi-signature wallet operated by DeFi United
- The recovery initiative now sits approximately 10% away from securing sufficient ETH to completely restore rsETH’s underlying backing
- Legal complications have trapped 30,765 ETH frozen by Arbitrum DAO following a restraining notice from a US legal firm
- The protocol’s total value locked has bounced back from $14.2B to surpass $15B once again
The decentralized lending platform Aave has successfully liquidated all outstanding rsETH positions controlled by the individual behind the Kelp DAO security breach across both Ethereum and Arbitrum networks. This action represents a significant milestone in DeFi United’s collaborative recovery initiative aimed at restoring proper backing to rsETH and compensating victims of the security incident.
All liquidated assets have been routed to the Recovery Guardian, a specialized multisignature wallet under DeFi United’s management. The protocol emphasized that the liquidation process did not impact any user funds and was executed without tapping into Aave’s Umbrella insurance safety net.
The security breach on April 18 involved a malicious actor—believed to have connections to North Korean entities—who exploited vulnerabilities in Kelp DAO’s LayerZero-integrated bridge infrastructure. This allowed the fraudulent creation of 116,500 rsETH tokens without proper backing on Ethereum. These fabricated tokens were subsequently deposited as collateral across multiple lending platforms, including Aave and Compound, to extract wrapped Ether loans.
The exploitation left Aave holding over $190 million in uncollectible debt and sparked widespread panic withdrawals. In the immediate aftermath, the protocol experienced a dramatic decline in total value locked, plummeting by almost $12 billion within the first week after the incident.
To enable the liquidation process, Aave’s governance community approved a temporary modification to the rsETH oracle pricing mechanism. This adjustment created an undercollateralized state in the attacker’s borrowing position, triggering automatic liquidation protocols. The oracle configuration was subsequently returned to standard parameters.
DeFi United has successfully gathered contributions exceeding $320 million. Galaxy Digital’s vice president of research, Thaddeus Pinakiewicz, indicated that the fund requires approximately 10% additional ETH to completely eliminate the backing deficit.
Legal Challenges Impede Asset Recovery
A complicating factor has emerged that threatens to delay full recovery. Following Arbitrum DAO’s decision to immobilize 30,765 ETH linked to the attack with intentions to allocate it toward DeFi United, Gerstein Harrow LLP—a US-based law firm—submitted a restraining notice last Friday seeking to prevent the transfer.
The legal firm is pursuing claims on the frozen assets as compensation connected to terrorism-related legal judgments against North Korea. Aave has countered by submitting an emergency legal motion requesting the restraining notice be dismissed.
Arbitrum DAO community members continue deliberating on whether to approve the fund release to DeFi United, with more than 90% of voting participants supporting the transfer. The voting period concludes this Friday.
Awaiting Commitments from Key Industry Players
DeFi United remains in discussions with several major stablecoin providers—Circle, Ethena, and Frax—as well as Kraken’s Ethereum layer 2 solution Ink, regarding formal contribution pledges.
According to Pinakiewicz, securing these commitments is essential to “get it over the line and plug the hole.”
Aave’s total value locked has demonstrated resilience and signs of recovery. Data from DefiLlama indicates the protocol rebounded from its April 26 nadir of $14.2 billion to climb back above the $15 billion threshold in recent trading sessions.
Withdrawal activity from Aave’s lending infrastructure has substantially decreased over the past seven days. Friday’s conclusion of the Arbitrum DAO governance vote represents a critical juncture that will likely determine whether the restoration plan can achieve its full objectives.
