Aave Liquidates Kelp DAO Hacker’s Positions in Push to Recover $293M Exploit Losses

TLDR

• Aave liquidated the Kelp DAO attacker’s remaining rsETH positions on Ethereum and Arbitrum
• The liquidated collateral was moved to Recovery Guardian, a multisig wallet run by DeFi United
• DeFi United is now only ~10% short of the ETH needed to fully restore rsETH backing
• 30,765 ETH frozen by Arbitrum DAO is stuck in legal limbo after a US law firm filed a restraining notice
• Aave’s total value locked has recovered from $14.2B back above $15B

Aave has liquidated the remaining rsETH positions held by the Kelp DAO attacker on both Ethereum and Arbitrum. The move is part of a community recovery effort called DeFi United, which is working to restore rsETH’s backing and repay users affected by the exploit.

The liquidated collateral has been transferred to the Recovery Guardian, a multisignature wallet managed by DeFi United. Aave confirmed that no user funds were affected by the liquidations and that its Umbrella insurance mechanism was not used.

The April 18 exploit involved an attacker — suspected to have ties to North Korea — who manipulated Kelp DAO’s LayerZero-powered bridge to fraudulently mint 116,500 unbacked rsETH tokens on Ethereum. Those tokens were then used as collateral on lending platforms including Aave and Compound to borrow wrapped Ether.

The hack left Aave with more than $190 million in bad debt and triggered a wave of withdrawals. The protocol’s total value locked dropped by nearly $12 billion in the week following the attack.

To carry out the liquidations, Aave went through a governance vote to temporarily adjust the rsETH oracle price. This created a deficit in the attacker’s position, allowing the liquidation to proceed. The oracle has since been restored to its normal configuration.

Contributions to DeFi United have now exceeded $320 million. According to Thaddeus Pinakiewicz, vice president of research at Galaxy Digital, the fund is roughly 10% short of the ETH needed to fully close the gap.

Legal Battle Complicates Recovery

A separate issue is slowing the process. Arbitrum DAO voted to freeze 30,765 ETH connected to the attack, with plans to send it to DeFi United. However, US law firm Gerstein Harrow LLP filed a restraining notice last Friday to block that transfer.

The firm is attempting to claim the frozen ETH as restitution tied to terrorism-related judgments against North Korea. In response, Aave filed an emergency motion to vacate the restraining notice.

Arbitrum DAO members are still voting on whether to release the funds to DeFi United, with over 90% of participants voting in favor. The vote is scheduled to close on Friday.

Waiting on Stablecoin Commitments

DeFi United is also waiting on formal commitments from stablecoin issuers Circle, Ethena, and Frax, along with Kraken-built Ethereum layer 2 network Ink.

Aave’s TVL has shown signs of stabilization. DefiLlama data shows the protocol recovered from a low of $14.2 billion on April 26 to above $15 billion in recent days.

Net outflows from Aave’s lending markets have eased over the past week. The Arbitrum DAO vote closing Friday will be a key moment in determining whether the recovery plan can reach completion.

The post Aave Liquidates Kelp DAO Hacker’s Positions in Push to Recover $293M Exploit Losses appeared first on CoinCentral.