Kelp DAO Attack Update: Aave Wipes Out Remaining rsETH Position

Aave has successfully completed the liquidation of the remaining rsETH position held by the Kelp DAO attacker. This action marks a critical milestone in the recovery plan following the $292 million exploit that shook the DeFi ecosystem.

The collateral obtained from this liquidation will be transferred to a multi-signature wallet called Recovery Guardian.

This wallet is managed by DeFi United, a coordinated relief effort led by Aave service providers. 

The funds will be used to restore the rsETH asset backing and compensate affected users.

Key Takeaways

• Aave completed liquidation of the remaining rsETH position held by the Kelp DAO attacker. The collateral will be transferred to DeFi United Recovery Guardian multisig wallet.

• DeFi United has secured over $320 million in support following the April 28 attack. The attacker exploited a LayerZero cross-chain bridge vulnerability to mint 116,500 unbacked rsETH tokens worth $292 million.

• The liquidation process required Aave to go through its governance system. The community approved a proposal to temporarily adjust the rsETH oracle price. 

Trade with confidence. Bitrue is a secure and trusted crypto trading platform for buying, selling, and trading Bitcoin and altcoins.
Register Now to Claim Your Prize!

Aave has confirmed that all adjusted parameters will be fully restored after the liquidation is completed. The protocol expects no long-term impact from this temporary governance action.

Timeline of the Kelp DAO Attack

The incident began on April 28, 2026. An attacker reportedly linked to North Korea exploited a cross-chain bridge vulnerability in the LayerZero-based Kelp DAO system.

The attacker fraudulently minted approximately 116,500 unbacked rsETH tokens on the Ethereum network. These tokens had no real collateral backing them.

After minting the fraudulent rsETH, the attacker deposited the tokens into lending protocols including Aave and Compound. The attacker then borrowed and cashed out ETH from these platforms.

The total loss from the attack reached approximately $292 million, making it one of the larger DeFi exploits in recent months.

Read also : What is AAVE? A Crypto Asset Lending Platform You Need to Know

DeFi United Recovery Efforts

Following the attack, the DeFi community took coordinated action to minimize damage and recover funds. DeFi United was established as a relief effort to organize these activities.

The group has successfully frozen relevant wallet addresses and recovered a significant portion of the stolen assets. To date, DeFi United has secured over $320 million in support commitments from various participants in the ecosystem.

The Recovery Guardian multisig wallet now holds the liquidated collateral from the attacker position. This wallet will distribute funds according to the recovery plan approved by the community.

Read also : Stake Your AAVE | Earn AAVE Staking Rewards

LayerZero Bridge Vulnerability

The attack exploited a vulnerability in a cross-chain bridge operated by Kelp DAO that was built on LayerZero technology. Cross-chain bridges have historically been a major target for hackers due to their complexity and large pool of locked funds.

The attacker was able to bypass normal collateral requirements and mint unbacked rsETH tokens. 

This type of exploit is known as a cross-chain bridge vulnerability, where trust assumptions between different networks are manipulated.

After the exploit was discovered, the Arbitrum Security Council voted to freeze some of the involved funds. However, these assets are now tangled in litigation related to North Korea-linked compensation claims.

Aave Governance Response

Aave response to the attack demonstrated the importance of decentralized governance in handling emergencies. The protocol did not act unilaterally but instead went through its governance process.

The community voted to temporarily manipulate the rsETH oracle price. Oracle prices determine the value of collateral used in lending positions. By adjusting the price downward, the attacker position became undercollateralized.

Once undercollateralized, the position became eligible for liquidation according to Aave standard protocol rules. Aave then completed the liquidation through its normal mechanisms.

This approach allowed Aave to recover funds while maintaining the integrity of its protocol rules. It also set a precedent for how DeFi protocols can respond to exploits without resorting to emergency shutdowns.

Read also : Is AAVE Still Safe to Use in 2026 After the Recent Incident?

What Happens Next 

With the final liquidation complete, the focus shifts to distributing recovered funds to affected users. The Recovery Guardian multisig wallet will manage this distribution according to the plan developed by DeFi United.

The compensation process will likely take some time as claims are verified and funds are allocated. However, the community has committed to making affected users whole to the extent possible.

Litigation related to the North Korea-linked funds remains ongoing. The Arbitrum Security Council freeze of certain assets is now being contested in legal proceedings.

Aave has returned to normal operations with all oracle parameters restored. The protocol has stated that there is no long-term impact from the temporary governance adjustment.

Conclusion

Aave has completed the liquidation of the remaining rsETH position held by the Kelp DAO attacker. The collateral will be transferred to the DeFi United Recovery Guardian multisig wallet. These funds will be used to restore the rsETH reserve and compensate affected users.

The liquidation was made possible through an Aave governance vote that temporarily adjusted the rsETH oracle price. All parameters have now been restored to normal. DeFi United has secured over $320 million in support for the recovery effort.

This incident marks one of the final stages in addressing the $292 million attack that began on April 28. 

The attacker exploited a LayerZero-based cross-chain bridge vulnerability to mint 116,500 unbacked rsETH tokens.

Frequently Asked Questions (FAQs)

What happened in the Kelp DAO attack?

An attacker exploited a LayerZero cross-chain bridge vulnerability on April 28, 2026, minting 116,500 unbacked rsETH tokens and borrowing ETH worth approximately $292 million.

What did Aave do in response?

Aave governance voted to temporarily adjust the rsETH oracle price, making the attacker position undercollateralized and triggering liquidation. The liquidation is now complete.

What is DeFi United?

DeFi United is a coordinated relief effort led by Aave service providers following the Kelp DAO attack. The group has secured over $320 million in support.

How will affected users be compensated?

The liquidated collateral will be transferred to the Recovery Guardian multisig wallet, which will distribute funds to restore the rsETH reserve and compensate affected users.

Who was behind the attack?

The attacker is reportedly linked to North Korea, according to multiple sources. Some frozen funds are now involved in litigation related to North Korea-linked compensation claims.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.