A coalition of decentralized finance players under “DeFi United” has unveiled a coordinated recovery plan to restore full backing for Kelp DAO’s rsETH token following a $292 million exploit earlier this month.
The attack, which occurred on April 18, targeted Kelp DAO’s bridge infrastructure through a forged message, allowing the attacker to mint 116,500 unbacked rsETH tokens. A significant portion, about 107,000 rsETH was subsequently deployed into lending positions on Aave, amplifying systemic risk across the ecosystem.
— Aave (@aave) April 28, 2026
Coordinated recovery strategy takes shape
To address the deficit, DeFi United has secured over $300 million in ETH commitments from ecosystem participants. The plan centres on converting this ETH into rsETH in structured tranches, gradually restoring the token’s backing.
Rather than executing a one-time fix, the coalition will route the converted rsETH into the affected lockbox contract in stages. This phased approach is designed to maintain stability while supporting the resumption of bridge operations.
According to the group, the staggered process reflects ongoing security considerations, particularly with new safeguards implemented across LayerZero and Kelp DAO systems. By pacing the restoration, the coalition aims to reduce the risk of further disruptions or exploitation during recovery.
Lending protocol exposure and liquidation plan
Beyond restoring backing, the initiative also focuses on unwinding risky lending positions tied to the exploit. Eight affected positions across Aave’s Ethereum Core and Arbitrum markets are set for cleanup, with an estimated recovery of around 13,000 ETH.
The strategy involves a controlled liquidation sequence, including a temporary adjustment to the rsETH oracle price. This move will enable the orderly liquidation of positions, with recovered collateral transferred to a multisig wallet managed by DeFi United.
A similar approach may be deployed on Compound, where the attacker holds additional positions worth roughly 16,776 ETH. The final phase of the plan includes unpausing rsETH markets, restoring loan-to-value ratios, and normalizing operations across affected platforms.
In related development, Volo Protocol, a liquid staking and decentralized finance (DeFi) platform on the Sui network, suffered a significant security breach on April 21, 2026, resulting in the theft of approximately $3.5 million.
Enjoyed this piece? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and Coin MarketCap Community for seamless access to high-quality industry insights.
“Take control of your crypto portfolio with DeFi Planet PRO, DeFi Planet’s suite of analytics tools.”
