.png){kind=logo}
DeFi United has published a technical recovery plan to restore full backing for Kelp DAO’s rsETH after a $292 million exploit affected major DeFi lending markets. The coalition, led by Aave and supported by dozens of protocols, has secured more than $300 million in ETH commitments to support the restoration process. The plan now depends on governance approvals, execution timelines, and final agreements before it can move forward.
The April 18 exploit targeted the rsETH bridge route from Unichain to Ethereum. A forged inbound packet passed verification on Ethereum without a matching burn on Unichain. As a result, the attacker released 116,500 unbacked rsETH from the Ethereum-side adapter.
The exploit has been widely attributed to North Korea’s Lazarus Group. After the release, the attacker distributed the rsETH across several addresses and DeFi venues.
DeFi United said the restoration will convert committed ETH into rsETH in several tranches. The coalition will then transfer the rsETH to the affected lockbox contract. This step aims to let the bridge resume full operation under a controlled process.
The tranche-based approach comes as LayerZero and Kelp are applying extra security measures before bridge operations restart. According to the plan, staged deposits will help manage risk while the new protections face real market conditions.
The coalition said it has gathered enough ETH commitments to restore full backing. Even so, deployment still requires final agreements and governance approval. That means the recovery process will not begin automatically.
In parallel, DeFi United aims to clear eight affected positions across Aave Ethereum Core and Aave Arbitrum. Aave said this step is necessary to recover about 13,000 ETH in funds and resolve market impairment.
The attacker used part of the released rsETH as collateral on Aave V3 Ethereum. Another portion moved to Arbitrum, where it supported more lending positions. Current data in the plan shows that seven exploiter-linked addresses still hold active rsETH-backed positions on Aave and Compound.
Together, those positions represent about 107,000 rsETH from the original 116,500 rsETH released. The recovery effort targets two goals. First, it aims to restore rsETH backing. Then, it seeks to clear affected liquidity market positions and recover excess collateral.
The technical process requires governance proposals on Ethereum and Arbitrum. Under the plan, Aave will temporarily adjust the rsETH oracle price. That move will allow controlled liquidation of the affected positions.
After liquidation, recovered rsETH collateral will move to a DeFi United-controlled multisig. The coalition will then redeem the rsETH for ETH through Kelp DAO’s standard process. The resulting ETH will repay temporary deficits in Aave markets.
Read More: April 2026 Crypto Hacks Hit $606M in 18 Days Across DeFi Platforms
Compound will follow a similar path for the exploiter’s position. DeFi United will provide the liquidity needed for that process. According to the plan, the Compound effort could recover about 16,776 ETH after completion.
During the recovery period, WETH and rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle, and Linea will remain frozen. These freezes aim to contain risk while protocols prepare for liquidation and restoration.
Once the collateral recovery ends, the rsETH price oracle will return to normal. After that, the recovered ETH will cover deficits across the affected Aave Ethereum and Arbitrum markets.
The final operational phase will unpause and unfreeze rsETH and ETH across affected instances. Protocols will also restore loan-to-value ratios for ETH and any other assets that received temporary configuration changes.
Aave said all configuration adjustments tied to the recovery remain temporary. The protocol expects no lasting changes to Aave after the governance proposals are executed.
The plan also lists several risks. Governance proposals must pass and execute correctly on Ethereum and Arbitrum. The attacker could also interfere, which may require more liquidation steps to fully resolve the affected positions.
DeFi United said public updates will follow as the recovery progresses. The coalition said successful execution would restore rsETH backing and stabilize the affected markets.
DeFi United’s recovery plan aims to restore rsETH backing after the Kelp DAO exploit while clearing affected Aave and Compound positions. The process depends on governance approvals, controlled liquidations, and coordinated ETH deployment. Market stability now relies on smooth execution across the affected DeFi protocols.
