DeFi United, the multi-protocol coalition formed in the wake of the April 18 Kelp DAO bridge exploit, has published the technical implementation plan to restore rsETH’s collateral backing and unwind the exploiter’s residual positions across Aave and Compound — the most detailed operational blueprint released since the $292 million incident.
The plan, disclosed via Aave’s official channel, lays out a two-track recovery: a tranche-based redeposit of ETH into Kelp DAO’s bridge lockbox to restore the rsETH peg and a coordinated, governance-approved liquidation sequence to recover collateral still locked in Aave V3 deployments on Ethereum and Arbitrum, as well as on Compound.
What Was Stolen, and Where It Sits Now
The April 18 exploit released 116,500 rsETH from the Ethereum-side LayerZero OFT adapter after a forged inbound packet was verified without a corresponding burn on Unichain. According to DeFi United’s disclosure, roughly 107,000 rsETH of that haul remains parked across seven addresses in active rsETH-backed positions on Aave and Compound — meaning the bulk of the stolen collateral is still on-chain and, in principle, recoverable.
The remainder was bridged to Arbitrum and routed through other venues. Arbitrum’s Security Council froze roughly 30,766 ETH ($71 million) of the downstream proceeds on April 21, and a separate governance proposal filed April 25 seeks to release those funds to the recovery effort.
Track One: Restoring rsETH’s Backing
DeFi United said it has secured ETH commitments sufficient to restore rsETH’s full backing at its current Kelp exchange ratio of 1.07 ETH per rsETH. The plan calls for converting the committed ETH into rsETH in tranches, then transferring it into the bridge lockbox contract (the RSETH_OFTAdapter at 0x85d456b2…98ef3) before the bridge resumes normal operations.
Both LayerZero and Kelp have implemented additional security measures ahead of the restart, though the coalition acknowledged residual risk remains until those measures are validated in production—a key reason for the staged tranche approach rather than a single deposit.
The contributor base is already substantial. As reported by The Crypto Times, disclosed pledges previously reached approximately 69,642 ETH (~$161 million) from 14 ecosystem participants, with Consensys and Joe Lubin subsequently committing up to 30,000 ETH and the Aave DAO advancing a separate 25,000 ETH treasury proposal.
Track Two: A Controlled Liquidation Sequence
The mechanically novel piece of the plan is the unwinding of the exploiter’s positions. Because the exploiter’s rsETH collateral is unbacked, ordinary liquidations are not viable. DeFi United’s solution is a temporary oracle adjustment on Aave’s Ethereum and Arbitrum deployments, executed through governance proposals, that enables efficient liquidation of the seven affected positions.
Recovered rsETH will be transferred to a dedicated multisig managed by DeFi United, then redeemed for ETH through Kelp’s standard redemption process. The resulting ETH is earmarked to clear the deficit on both Aave markets—an estimated 13,000 ETH in recovery on Aave alone.
A parallel process on Compound, structured along similar lines and supported by DeFi United-provided liquidity, is expected to recover roughly 16,776 ETH worth of funds.
The coalition stressed that all configuration changes are scoped solely to the recovery and will be fully reverted on completion. WETH and rsETH reserves on Aave deployments across Ethereum Core, Arbitrum, Base, Mantle, and Linea will remain frozen throughout.
The Final Phase
Once the lockbox is whole and the affected positions are cleared, the plan calls for unpausing rsETH and ETH markets across all impacted instances and restoring loan-to-value ratios for ETH and any other temporarily adjusted assets.
The two tracks—backing restoration and position unwinding—can run in parallel, the coalition said, which should compress the timeline.
Execution Risks
DeFi United flagged three principal risks: ETH commitments still depend on finalized agreements and governance votes; the liquidation sequence requires governance proposals to pass and execute correctly on both Ethereum and Arbitrum, with possible interference from the attacker if positions don’t accrue full deficit; and the bridge restart carries residual security risk until the new measures are battle-tested.
The plan is explicitly designed to avoid socializing losses to rsETH holders—a notable break from how comparable DeFi failures have historically been resolved.
Also Read: Black April 2026: $606M Stolen, $13B TVL Exodus in DeFi’s Darkest Month
