The coalition has secured ETH commitments to refill the bridge in tranches and will use Aave and Compound governance proposals to liquidate the exploiter’s remaining positions.
DeFi United, a coalition of decentralized finance (DeFi) ecosystem participants, on Tuesday published the technical implementation plan to restore the backing of Kelp DAO’s rsETH and recover roughly 107,000 tokens still controlled by the exploiter.
The exploit targeted rsETH’s LayerZero-powered bridge on the Unichain to Ethereum route, where a forged inbound packet was verified on the Ethereum side without a corresponding burn on Unichain. The attack released 116,500 rsETH from the Ethereum-side adapter, with proceeds distributed across multiple addresses and supplied as collateral on lending protocols.
Seven addresses associated with the exploiter currently hold active rsETH-backed positions on Aave and Compound, representing approximately 107,000 rsETH of the original 116,500 rsETH stolen.
Restoring Backing
DeFi United said it has secured the ETH commitments needed to restore rsETH’s backing, with final execution subject to governance approvals and definitive agreements. The committed ETH will be converted into rsETH in tranches and transferred to the bridge lockbox contract, allowing the bridge to resume normal operation.
The process targets rsETH’s nominal exchange ratio of 1.07 ETH. The coalition’s fundraising effort has progressively chipped away at the original 163,200 ETH shortfall.
LayerZero Labs on Tuesday pledged more than 10,000 ETH to the effort, donating 5,000 ETH directly to DeFi United and depositing an additional 5,000 ETH to strengthen Aave markets’ liquidity. The firm said it would also strategically deepen liquidity for Aave’s GHO stablecoin.
Clearing Exploiter’s Positions
Recovering the exploiter’s excess collateral requires governance proposals pertaining to Aave’s Ethereum and Arbitrum deployments. The execution involves a controlled liquidation sequence: the rsETH oracle price will be temporarily adjusted to enable efficient liquidation, generating a temporary deficit to be addressed in a subsequent step. Recovered rsETH will be transferred to a DeFi United multisig and redeemed for ETH through Kelp’s standard redemption procedure, with the resulting ETH applied to clear the Aave Ethereum and Arbitrum deficits.
The Aave clearing process aims to recover approximately 13,000 ETH. Compound will take a similar approach with DeFi United providing the liquidity, recovering an estimated 16,776 ETH.
WETH and rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle, and Linea will remain frozen during the process. The final phase involves unpausing and unfreezing rsETH and ETH across affected instances and restoring loan-to-value ratios for any assets whose configurations were temporarily adjusted.
Risks
DeFi United flagged several execution risks. ETH deployment is contingent on finalizing agreements and governance approvals. Deliberate interference by the attacker could result in incomplete accrual of deficits, requiring additional liquidation steps to fully resolve the positions. Residual bridge risk also remains until the newly implemented LayerZero and Kelp security measures are validated in production.
This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.
