Aave Liquidates Kelp DAO hacker’s rsETH on Ethereum and Arbitrum

Aave Labs has completed the liquidation of the Kelp DAO attacker’s remaining rsETH collateral on Ethereum and Arbitrum, marking a concrete step in the DeFi United recovery plan to fully back rsETH and compensate affected users. Aave described the move as a “critical step,” with the liquidated collateral now routed to Recovery Guardian, a multisignature wallet overseen by DeFi United. Aave’s update on X notes that user funds were not touched in this process and that its Umbrella insurance mechanism was not activated.

With the latest liquidation, DeFi United estimates it is roughly 10% short of the ETH needed to restore full rsETH backing, according to Thaddeus Pinakiewicz, vice president of Galaxy Digital’s research team. The recovery plan has continued to hinge on securing additional ETH commitments and on governance decisions that can unlock the remaining liquidity for rsETH holders. The Kelp DAO attack in mid-April, which exploited about $293 million, has reverberated through the DeFi lending sector and raised questions about the resilience of cross-chain recovery efforts.

Aave stressed that the liquidation reduces liquidity risk without endangering user funds, and it reiterated that its automated protection for bad debt, Umbrella, was not invoked in this step. The development comes as DeFi United moves toward a broader funding package and a mix of on-chain and off-chain governance actions aimed at restoring rsETH’s collateralization and legitimacy.

Key takeaways

• 13,000 ETH liquidated from the attacker’s collateral on Ethereum and Arbitrum would be released to Recovery Guardian, a DeFi United multisignature wallet, equating to roughly $30.2 million at current prices.
• Approximately 30,765 ETH remain frozen by Arbitrum DAO in “legal limbo” after a restraining notice was filed by US law firm Gerstein Harrow LLP to prevent redistribution. Aave has filed an emergency motion to vacate the restraining notice.
• Arbitrum DAO voting on the release of frozen ETH to the DeFi United fund shows overwhelming support — more than 90% in favor — with the vote closing on Friday.
• DeFi United is seeking commitments from Circle, Ethena, Frax, and Kraken-built Ethereum layer 2 Ink to “get it over the line and plug the hole,” according to project backers.
• Aave’s total value locked (TVL) has stopped its steep decline, with DefiLlama data showing a rebound above the $15 billion level after a period of outsized outflows tied to the Kelp DAO incident.

Recovery progress and the rsETH restoration plan

The liquidation of the attacker’s rsETH collateral on both Ethereum and Arbitrum represents a tangible step toward reinforcing the rsETH backstop. By transferring the collateral to Recovery Guardian, DeFi United aims to create a more predictable path for restitution to affected users and to reestablish the integrity of rsETH’s staking framework. While the total value of the liquidated portion sits in transit, observers are watching closely for the next tranche of ETH required to complete the backing.

Thaddeus Pinakiewicz of Galaxy Digital’s research team framed the current status as a near-term milestone rather than a finished cure. “DeFi United is roughly 10% short of the ETH needed to restore full rsETH backing,” he noted, underscoring how the plan’s success hinges on securing a relatively small but crucial slice of liquidity from the broader ecosystem. The remaining 30,765 ETH, currently frozen by Arbitrum DAO, illustrates the enduring tension between on-chain recovery mechanics and legal/organizational processes that govern cross-chain assets in crisis scenarios.

Legal contours, governance and the path forward

The legal dimension of the Kelp DAO incident remains a key obstacle. The restraining notice filed by Gerstein Harrow LLP aims to prevent redistribution of the frozen ETH while the matter unfolds in court, creating a “legal limbo” that could delay the final recovery steps. In response, Aave has lodged an emergency motion to vacate the restraining notice, signaling active legal maneuvering from the recovering coalition.

Meanwhile, Arbitrum DAO is in the thick of a governance vote about releasing the frozen ETH to the DeFi United fund. With more than 90% of participating voters in favor, the outcome could unlock a significant portion of the collateral needed to underpin rsETH. The vote is set to close on Friday, and the decision will test the DAO’s ability to balance fiduciary duty with the broader goal of DeFi resilience. For some observers, the situation also underscores the evolving role of DAOs in crisis response and the potential regulatory scrutiny that can accompany large-scale cross-chain fund movements.

Beyond the immediate goal of rsETH restoration, DeFi United has earmarked a broader set of commitments that could shape the recovery’s speed and effectiveness. The coalition is courting backing from Circle, Ethena, Frax, and Kraken’s Ethereum layer 2 solution Ink. Securing these commitments would help to “plug the hole” and accelerate the path back to a fully collateralized rsETH, while also signaling a willingness among major stablecoin issuers and L2 ecosystems to stand behind DeFi’s recovery efforts during a stress event.

Market impact and ecosystem resilience

The Kelp DAO incident remains among the most consequential hacks of 2026, with the initial shock driving a broad unwind across DeFi lending protocols. Aave’s TVL declined sharply as the attacker collateralized rsETH to borrow wrapped Ether, triggering a cascade of withdrawals and more than $190 million in bad debt on the platform. In the weeks that followed, DefiLlama’s data shows that net outflows from Aave’s lending markets have begun to ease, and the protocol’s total value locked has rebounded from its local trough to sit above the $15 billion mark again.

This rebound is not a victory lap. The episode exposed structural vulnerabilities in DeFi lending and cross-chain collateral arrangements, especially when attacker assets are pledged to secure new loans. The current recovery push—backed by on-chain governance, legal processes, and strategic partnerships with major stablecoins and L2 infrastructure—could shape how the market assesses risk and contingency planning in the months ahead. For borrowers and lenders alike, the episode reinforces the importance of rigorous collateralization, transparent governance, and robust rescue frameworks when incidents test the integrity of a protocol’s backstops.

As the governance process unfolds and the legal questions are resolved, investors and users should watch closely how quickly DeFi United can assemble the remainder of the ETH and how the community and regulators respond to the coordinated release of frozen assets. The balance between restoring rsETH’s credibility and maintaining prudent risk controls will likely influence funding, liquidity incentives, and the broader appetite for DeFi risk in the near term.

Readers should monitor updates from Aave, Arbitrum DAO, and DeFi United as the Friday vote concludes and as Circle, Ethena, Frax, and Ink’s involvement firm up. The outcome will help determine not only the fate of rsETH but also the broader precedent for crisis response in decentralized finance.