Kelp DAO Hacker's rsETH Holdings Liquidated by Aave on Ethereum and Arbitrum Networks
The DeFi United recovery initiative receives a major boost as Aave Labs successfully liquidates rsETH positions held by the Kelp DAO attacker across Ethereum and Arbitrum, bringing restoration efforts closer to completion for affected users.
The final rsETH positions belonging to the Kelp DAO hacker have been liquidated by Aave Labs across both Ethereum and Arbitrum networks, representing significant progress toward the complete restoration of rsETH backing and user compensation for those impacted by the attack.
According to a Wednesday announcement from Aave on X, this development represents a "critical step" in advancing the "DeFi United" recovery initiative. The post further confirmed that collateral from the April 18 exploit, which totaled $293 million, has been successfully transferred to Recovery Guardian, a multisignature wallet under DeFi United's management.
Based on analysis from Thaddeus Pinakiewicz, who serves as vice president of Galaxy Digital's research division, DeFi United now requires only approximately 10% more Ether (ETH) to completely restore the Kelp DAO restaked ETH (rsETH) token to its proper backing.
Among the most catastrophic cryptocurrency security breaches in 2026, the Kelp DAO exploit created widespread consequences across the DeFi lending sector, disrupting billions in liquidity and significantly undermining trust throughout the broader ecosystem.
According to Aave's statement, the liquidation process did not impact user funds, and the protocol's automated bad debt protection insurance mechanism known as Umbrella remained unused during the operation.
On April 28, Aave announced that liquidating the attacker's collateral positions across Ethereum and Arbitrum would free up 13,000 Ether, valued at approximately $30.2 million based on current market prices.
However, Pinakiewicz highlighted an additional complication involving 30,765 ETH that has been frozen by Arbitrum DAO and currently exists in "legal limbo" following a restraining notice filed by US law firm Gerstein Harrow LLP on Friday, which seeks to block Arbitrum DAO from redistributing the frozen ETH. Aave has countered this action by filing an emergency motion requesting the vacation of that restraining notice.
At the same time, Arbitrum DAO members continue to cast votes on a proposal concerning whether to release the frozen ETH to the DeFi United fund, with more than 90% of participants supporting the measure. The voting period is scheduled to conclude on Friday.
Additional commitments are still pending from stablecoin issuers including Circle, Ethena and Frax, along with Ink, the Ethereum layer 2 solution developed by Kraken, according to DeFi United's requirements.
According to Pinakiewicz, Aave requires these outstanding commitments to "get it over the line and plug the hole" in the recovery effort.
Aave's TVL bleeding has stopped
The Kelp DAO exploit dealt a severe blow to Aave, with the protocol experiencing a total value locked decline of nearly $12 billion within a single week following the incident. The attacker deposited the stolen rsETH tokens as collateral on Aave's lending platform to borrow wrapped Ether, creating over $190 million in bad debt and sparking a widespread withdrawal cascade across the platform.
According to DefiLlama data, the rate of net outflows from Aave's lending markets has diminished significantly throughout the past week, with the protocol's total value locked recovering from a local bottom of $14.2 billion recorded on April 26 to climb back above the $15 billion threshold.
