DeFi United plans rsETH recovery after $292 million Kelp DAO exploit

DeFi United has released a recovery plan to restore full backing for Kelp DAO’s rsETH after a $292 million exploit earlier this month. 

The coalition includes several DeFi protocols that joined efforts after the attack. The April 18 exploit targeted Kelp DAO’s rsETH bridge through a forged message. The attacker minted 116,500 unbacked rsETH tokens. Around 107,000 rsETH later moved into lending positions on Aave.

The recovery plan will convert committed ETH into rsETH in several tranches. The converted rsETH will then move to the affected lockbox contract to restore backing and support bridge operations.

Aave said DeFi United has gathered enough ETH commitments to begin the process. The initiative raised more than $300 million in ETH from DeFi participants.

Aave and Compound positions face cleanup

The plan also targets eight affected positions across Aave Ethereum Core and Arbitrum markets. Clearing those positions may help recover about 13,000 ETH from Aave.

The process will use a controlled liquidation sequence. The rsETH oracle price will be adjusted for a short period to allow the affected positions to be liquidated. The rsETH collateral will then move to a DeFi United-controlled multisig.

Compound may follow a similar path to clear the attacker’s position. That step could recover about 16,776 ETH worth of funds, according to the recovery outline.

The final phase will unpause and unfreeze rsETH and ETH across affected markets. It will also restore loan-to-value ratios that were changed during the response.

Governance approvals and security checks remain

The recovery plan still depends on governance approvals, legal agreements, and execution timelines. DeFi United said these steps must happen before the full restoration can move forward.

The coalition also noted that the attacker could try to interfere during the process. It said such action could require more liquidation steps to resolve the affected positions.

DeFi United also said new security measures on LayerZero and Kelp DAO remain in production. For that reason, the ETH-to-rsETH conversion and lockbox deposits will happen in stages rather than all at once.