Aave completes liquidation of Kelp DAO attacker’s final rsETH positions

Aave Labs has completed the liquidation of the Kelp DAO attacker’s remaining rsETH-backed positions on Ethereum and Arbitrum, moving the DeFi United recovery effort closer to restoring full backing for the restaked Ether token after April’s $293 million exploit.

Aave said in an X post on Wednesday that the collateral recovered from the liquidations has been transferred to Recovery Guardian, a multisignature wallet controlled by the DeFi United recovery group. According to Aave, the process did not impact user funds, and the protocol’s Umbrella protection system was not activated during the operation.

Galaxy Digital research vice president Thaddeus Pinakiewicz noted that DeFi United is now about 10% short of the Ether needed to fully recapitalise rsETH. Recovery efforts still depend on additional support from stablecoin issuers Circle, Ethena, and Frax, along with Ink, the Ethereum layer 2 network developed by Kraken.

“Aave needs these commitments to get it over the line and plug the hole,” Pinakiewicz said.

The liquidation clears part of the damage left behind after hackers drained 116,500 rsETH from Kelp DAO’s bridge infrastructure on April 18. 

According to Kelp DAO, the stolen assets were later deposited into Aave v3 as collateral to borrow wrapped Ether, creating more than $190 million in bad debt and triggering billions of dollars in disruptions across DeFi lending markets.

Frozen ETH dispute moves into legal fight

Part of the recovery process remains tied to 30,765 ETH worth roughly $71 million that was frozen by Arbitrum DAO after the exploit. Pinakiewicz said the assets remain in “legal limbo” after U.S. law firm Gerstein Harrow LLP filed a restraining notice seeking to stop the funds from being redistributed.

According to previous court filings reported by crypto.news, Aave filed an emergency motion in New York on May 4 asking the court to vacate the restraining notice. Aave argued the frozen Ether should be returned to affected users and said no court has determined that North Korea, Lazarus Group, or any related entity carried out the exploit.

Arbitrum Security Council froze the funds on April 21 after they were traced to addresses linked to the rsETH attack. Members of Arbitrum DAO are still voting on whether Ether should be released to the DeFi United recovery fund, with more than 90% of votes currently supporting the proposal. Voting is expected to close on Friday.

Separate tensions have also emerged between Kelp DAO and LayerZero over the bridge configuration tied to the exploit. Kelp DAO said on May 6 that it plans to migrate rsETH to Chainlink’s Cross-Chain Interoperability Protocol after the attack exposed weaknesses in the LayerZero-linked setup used by the protocol.

Kelp DAO claimed LayerZero had previously approved the single verifier configuration that was later blamed for the exploit. LayerZero co-founder and CEO Bryan Pellegrino rejected those claims and said Kelp moved away from LayerZero’s default multi-verifier setup on its own.

While recovery talks continue, DefiLlama data shows outflows from Aave’s lending markets have slowed in recent days. Aave’s total value locked has climbed back above $15 billion after falling to nearly $14.2 billion in the aftermath of the exploit.