DeFi United has released a recovery plan to restore full backing for Kelp DAO’s rsETH after a $292 million exploit earlier this month. Summary DeFi United will convert committed ETH into rsETH tranches to restore full backing after the exploit. Aave may recover about 13,000 ETH through controlled liquidations of eight affected lending positions. The recovery still needs governance approvals, legal agreements, and staged security checks before full execution. The coalition includes several DeFi protocols that joined efforts after the attack. The April 18 exploit targeted Kelp DAO’s rsETH bridge through a forged message. The attacker minted 116,500 unbacked rsETH tokens. Around 107,000 rsETH later moved into lending positions on Aave. The recovery plan will convert committed ETH into rsETH in several tranches. The converted rsETH will then move to the affected lockbox contract to restore backing and support bridge operations. “The restoration process involves converting the committed ETH into rsETH in tranches, which will then be transferred to the affected lockbox contract,” the coalition said. Aave said DeFi United has gathered enough ETH commitments to begin the process. The initiative raised more than $300 million in ETH from DeFi participants. Aave and Compound positions face cleanup The plan also targets eight affected positions across Aave Ethereum Core and Arbitrum markets. Clearing those positions may help recover about 13,000 ETH from Aave. The process will use a controlled liquidation sequence. The rsETH oracle price will be adjusted for a short period to allow the affected positions to be liquidated. The rsETH collateral will then move to a DeFi United-controlled multisig. Compound may follow a similar path to clear the attacker’s position. That step could recover about 16,776 ETH worth of funds, according to the recovery outline. The final phase will unpause and unfreeze rsETH and ETH across affected markets. It will also restore loan-to-value ratios that were changed during the response. Governance approvals and security checks remain The recovery plan still depends on governance approvals, legal agreements, and execution timelines. DeFi United said these steps must happen before the full restoration can move forward. The coalition also noted that the attacker could try to interfere during the process. It said such action could require more liquidation steps to resolve the affected positions. “Deliberate interference by the attacker could result in incomplete deficit accrual, requiring additional liquidation steps to fully resolve the positions,” the statement said. DeFi United also said new security measures on LayerZero and Kelp DAO remain in production. For that reason, the ETH-to-rsETH conversion and lockbox deposits will happen in stages rather than all at once.
