Aave Begins Phase II Recovery After Liquidating Hacker-Linked Positions

• Aave liquidated 8 hacker-linked positions tied to the rsETH exploit on Aave V3.
• A Manhattan federal judge allowed the transfer of frozen $71M in ETH to support recovery.
• Aave will burn the seized rsETH and retire the related LayerZero packet.

Aave has moved into the second phase of its rsETH recovery plan after liquidating the hacker-linked positions tied to last month’s exploit on Aave V3 across Ethereum and Arbitrum.

In an update posted on X, the protocol confirmed that the thief’s eight identified positions were liquidated on May 6. The recovered rsETH collateral was transferred to the Recovery Guardian under a governance proposal previously approved by the Aave DAO.

The exploit, linked to North Korea’s Lazarus Group, allowed attackers to use unbacked rsETH as collateral to borrow nearly $230 million in ETH from the protocol. Arbitrum’s Security Council later froze 30,765 ETH, worth roughly $71 million, connected to the attack.

Aave said normal users and Umbrella stakers were not affected during the liquidation process.

Court Clears Path for Asset Transfer

The recovery effort faced legal complications after families holding terrorism judgments against North Korea attempted to claim the frozen ETH through a restraining notice filed in Manhattan federal court.

The plaintiffs argued the funds should be treated as North Korean property because the exploit was widely attributed to Lazarus Group.

Judge Margaret Garnett later modified the restraining order, allowing an on-chain Arbitrum governance vote to transfer the immobilized ETH to an Aave-controlled wallet while preserving the plaintiffs’ legal claims.

The order also protected Arbitrum governance participants from liability tied to the transfer vote. 

rsETH Supply to Be Burned

The next stage of the recovery plan focuses on restoring rsETH backing and reopening bridge operations.

On Arbitrum, the liquidated rsETH will be burned. After that, Kelp will retire the corresponding LayerZero packet on Ethereum to stop any additional rsETH from being minted through the exploit-linked cross-chain message.

Aave said the two-step process will neutralize the inflated rsETH supply created during the attack.

On Ethereum, the seized rsETH will be transferred into the bridge lockbox. Combined with ETH committed by members of the broader DeFi United coalition, the funds will restore backing for the rsETH lockbox contract.

Once the lockbox is fully backed, bridge operations and rsETH withdrawals will resume.

Temporary market settings introduced during the exploit response will also be reversed. Aave confirmed that the loan-to-value ratio for WETH on Aave V3 Ethereum Core, previously reduced to zero as a precaution, will soon return to normal levels.

Related: TRON and HTX Commit $20M USDT to Aave V3 to Support TRON Expansion