Aave liquidates Kelp DAO hacker’s rsETH positions on Ethereum and Arbitrum, advancing recovery

Aave Labs has successfully liquidated the Kelp DAO attacker’s remaining rsETH positions on the Ethereum and Arbitrum networks, marking a significant milestone in the ongoing effort to recover funds from the $293 million exploit that occurred on April 18. The liquidation, confirmed by Aave on Wednesday, represents a critical step in the ‘DeFi United’ recovery plan, which aims to restore the backing of the rsETH token and compensate affected users.

Recovery progress and remaining hurdles

The liquidated collateral has been transferred to Recovery Guardian, a multisignature wallet managed by the DeFi United coalition. According to Thaddeus Pinakiewicz, vice president of Galaxy Digital’s research team, DeFi United is now only about 10% short of the Ether (ETH) needed to fully restore the rsETH token. This progress comes after Aave initially stated on April 28 that clearing the hacker’s collateral would release approximately 13,000 ETH, valued at nearly $30.2 million at current prices.

Also read: Bermuda to move key financial services onto Stellar blockchain, premier says

However, challenges remain. Pinakiewicz noted that an additional 30,765 ETH, frozen by Arbitrum DAO, is currently in ‘legal limbo’ after US law firm Gerstein Harrow LLP filed a restraining notice on Friday to prevent Arbitrum DAO from redistributing the frozen funds. In response, Aave has filed an emergency motion to vacate the restraining notice. Meanwhile, members of Arbitrum DAO are voting on whether to release the frozen ETH to the DeFi United fund, with over 90% of voters in favor. The voting is set to close on Friday.

Broader implications for DeFi lending

The Kelp DAO exploit has been one of the most devastating crypto hacks in 2026, triggering a ripple effect across the decentralized finance (DeFi) lending market. The hacker used the stolen rsETH tokens as collateral on Aave’s lending platform to borrow wrapped Ether, leaving over $190 million in bad debt and causing a wave of withdrawals. Aave’s total value locked (TVL) fell by nearly $12 billion in the week following the exploit, dropping from over $26 billion to a local low of $14.2 billion on April 26.

Also read: Senate CLARITY Act markup faces ethics debate as North Korea crypto thefts hit $2B and Bitmine slows Ether buys

Data from DefiLlama shows that net outflows from Aave’s lending markets have eased over the past week, with the protocol’s TVL recovering to above the $15 billion mark. Aave has emphasized that user funds were not affected by the liquidations and that its insurance mechanism, Umbrella, was not used to cover the bad debt.

DeFi United’s ongoing efforts

DeFi United is also awaiting commitments from stablecoin issuers Circle, Ethena, and Frax, as well as Kraken-built Ethereum layer 2 Ink, to fully plug the remaining shortfall. Pinakiewicz noted that these commitments are essential to ‘get it over the line and plug the hole.’ The coordinated response from multiple DeFi protocols and entities highlights the industry’s growing resilience and willingness to collaborate in the face of large-scale exploits.

Conclusion

The liquidation of the Kelp DAO hacker’s positions on Ethereum and Arbitrum represents a significant step forward in the recovery process, but legal and governance hurdles remain. The outcome of the Arbitrum DAO vote and the resolution of the restraining order will be critical in determining whether DeFi United can fully restore the rsETH token and restore confidence in the DeFi lending ecosystem. The incident underscores the ongoing risks in DeFi while also demonstrating the industry’s capacity for coordinated crisis response.

FAQs

Q1: What was the Kelp DAO hack and how did it affect Aave?
The Kelp DAO hack on April 18 resulted in the theft of $293 million in rsETH tokens. The hacker used the stolen tokens as collateral on Aave to borrow wrapped Ether, leaving over $190 million in bad debt and causing a significant drop in Aave’s total value locked.

Q2: What is the DeFi United recovery plan?
DeFi United is a coalition of DeFi protocols and entities formed to coordinate the recovery of funds from the Kelp DAO exploit. The plan involves liquidating the hacker’s collateral, recovering frozen assets, and restoring the backing of the rsETH token.

Q3: What are the remaining challenges to full recovery?
The main challenges include the legal dispute over 30,765 ETH frozen by Arbitrum DAO, which is subject to a restraining order, and the need for commitments from stablecoin issuers and other entities to cover the remaining 10% shortfall in ETH needed to restore rsETH.

Written by

Jackson Miller

Jackson Miller is a senior cryptocurrency journalist and market analyst with over eight years of experience covering digital assets, blockchain technology, and decentralized finance. Before joining CoinPulseHQ as lead writer, Jackson worked as a financial technology correspondent for several business publications where he developed deep expertise in derivatives markets, on-chain analytics, and institutional crypto adoption. At CoinPulseHQ, Jackson covers Bitcoin price movements, Ethereum ecosystem developments, and emerging Layer-2 protocols.