Aave-linked DeFi United unveils rsETH recovery plan after $293M Kelp exploit

The Aave-linked recovery group DeFi United has published a technical implementation plan to restore rsETH backing after the April 18 Kelp bridge exploit released 116,500 rsETH, worth about $293 million at the time, without a corresponding burn on Unichain.

The plan would convert committed Ether (ETH) into rsETH in tranches and deposit the tokens into the affected bridge lockbox, allowing the bridge to resume normal operations once the backing is restored. LayerZero and Kelp have also implemented additional security measures before the bridge returns to full operation, according to Aave. 

In parallel, DeFi United plans to clear attacker-linked positions across Aave and Compound to recover collateral and resolve market impairments caused by the exploit. The group said seven addresses associated with the exploiter still hold active rsETH-backed positions on Aave and Compound, representing about 107,000 rsETH of the original 116,500 rsETH released in the incident.

Related: Kelp restaking platform exploited, $293M drained in attack

The proposed sequence would temporarily adjust the rsETH oracle price to enable controlled liquidations, transfer recovered collateral to a DeFi United multisig, restore the oracle, redeem the rsETH for ETH and use the resulting funds to clear deficits across affected markets. 

The recovery plan moves the rsETH effort from pledges and public commitments into a coordinated technical process that depends on governance approvals, temporary oracle changes and execution across several DeFi protocols. While the process is designed to restore rsETH backing, it remains contingent on DAO votes, finalized agreements and the attacker not disrupting the liquidation steps.

Source: Aave

Ethereum backers joined the recovery effort

The technical plan follows earlier efforts to secure funding and governance support for the rsETH recovery. 

On Monday, Consensys and Ethereum co-founder Joe Lubin had joined DeFi United with a commitment of up to 30,000 ETH, while Sharplink, a publicly traded Ethereum treasury company, joined in an advisory role to help structure the recovery plan. 

Related: Crypto protocols pledge 43K ETH to restore rsETH backing

On the same day, Aave Labs had asked the Arbitrum DAO to release 30,765 ETH frozen by the Arbitrum Security Council after the exploit and send the funds to DeFi United. 

DeFi United secured over $300 million in commitments. Source: DeFi United

As of Tuesday, the DeFi United website showed $302.26 million in total raised or committed toward the recovery effort, equal to 132,706.903 ETH, though some commitments remain subject to DAO votes and final execution.

Magazine: AI-driven hacks could kill DeFi — unless projects act now