In brief
- The DeFi United coalition has published a technical implementation for restoring rsETH token backing following the Kelp DAO hack.
- The relief effort secured over $300 million in ETH commitments to eliminate bad debt on Aave and Compound.
- The plan converts committed ETH into rsETH, then liquidates hacker positions through governance-controlled oracle adjustments.
Aave-led coalition DeFi United has published a technical plan to restore backing for rsETH tokens and eliminate bad debt left by North Korean hackers on Aave and Compound.
The recovery strategy calls for converting committed ETH into rsETH in controlled tranches, then liquidating the attacker's positions through temporarily adjusted oracle prices. The coalition aims to recover approximately 13,000 ETH from affected positions on Aave's Ethereum and Arbitrum markets, and 16,776 ETH from Compound.
— Aave (@aave) April 28, 2026
The hackers had deposited 89,567 unbacked rsETH as collateral to borrow 82,650 WETH and 821 wstETH across the platforms. The Arbitrum Security Council has already frozen $71.5 million traced to the exploiter's addresses.
"Deliberate interference by the attacker could result in incomplete deficit accrual, requiring additional liquidation steps to fully resolve the positions," Aave warned.
The technical plan has backing from major industry players who have committed $303 million in total capital and credit as of Monday. Consensys and Joseph Lubin pledged up to 30,000 ETH, while Aave Labs CEO Stani Kulechov personally committed 5,000 ETH. Lido proposed allocating up to 2,500 stETH. (Disclosure: Consensys is one of 22 investors in an editorially independent Decrypt.)
“The Ethereum ecosystem has always been at its best when it moves together,” Lubin said, calling DeFi United a “broad, coordinated response to protect users and strengthen the infrastructure we’ve all helped build.”
The recovery effort addresses fallout from the April 18 Kelp DAO hack, in which North Korean attackers stole $293 million by tricking the protocol into releasing unbacked rsETH tokens. The hackers made off with 116,500 rsETH—18% of the token's circulating supply—leaving Aave and Compound exposed to worthless collateral.
It marks one of DeFi's largest coordinated recovery efforts since the sector's inception, with previous protocol exploits typically having left users to absorb losses individually.