DeFi United Plans rsETH Recovery After $293M Kelp Exploit
Following the $293M Kelp bridge exploit that released 116,500 rsETH, Aave-linked DeFi United unveiled a technical recovery plan. The effort involves liquidating attacker positions on Aave and Compound using committed ETH, subject to DAO votes.
Quick Take
Kelp exploit released 116,500 rsETH worth $293M; 107K still in attacker positions.
DeFi United plan: convert committed ETH to rsETH, liquidate positions.
Consensys, Lubin commit 30K ETH; total raised $302M.
Execution requires Arbitrum DAO vote and oracle adjustments.
Market Impact Analysis
BearishThe $293M exploit and ongoing recovery uncertainty weigh on rsETH and Kelp ecosystem; broader market may see limited impact.
Speculation Analysis
Key Takeaways
- The Kelp bridge exploit released 116,500 rsETH worth $293 million; 107,000 rsETH remain in attacker positions on Aave and Compound.
- DeFi United’s recovery plan will convert committed ETH to rsETH and liquidate attacker positions under temporary oracle adjustments.
- Consensys and Joe Lubin committed 30,000 ETH as part of $302 million in total pledges.
- Execution hinges on an Arbitrum DAO vote to release 30,765 ETH and governance approval for oracle changes.
What Happened
On April 18, the Kelp bridge on Unichain released 116,500 rsETH — valued at $293 million — without burning the equivalent tokens on the source chain. This created an unbacked liability, effectively draining the bridge. DeFi United, an Aave-linked recovery group, has now published a detailed technical plan to restore rsETH backing. The proposal aims to convert committed ETH into rsETH in tranches, deposit the tokens into the affected bridge lockbox, and systematically liquidate attacker-linked positions on Aave and Compound. LayerZero and Kelp have since implemented additional safeguards before the bridge can reopen. The bridge will only resume normal operations once backing is fully restored.
The Numbers
The exploit released 116,500 rsETH, of which approximately 107,000 rsETH remain across seven attacker-controlled addresses on Aave and Compound. DeFi United has secured $302.26 million in ETH commitments, equivalent to 132,706 ETH. Major backers include Consensys and Ethereum co-founder Joe Lubin, who pledged 30,000 ETH. The Arbitrum DAO is set to vote on releasing 30,765 ETH frozen by the Security Council after the incident. The recovery will involve temporary oracle price adjustments to enable controlled liquidations of the attacker’s positions. The total commitments exceed the initial loss, providing a buffer.
Why It Happened
The root cause was a failure in the Kelp bridge’s burn-and-mint mechanism: rsETH was released on the destination chain without a corresponding burn on the source chain. This flaw enabled the minting of 116,500 unbacked rsETH, triggering the crisis. The incident underscores the persistent vulnerabilities of cross-chain bridges, where state synchronization flaws can lead to massive liabilities. In response, LayerZero and Kelp have implemented additional security measures to prevent a recurrence before the bridge can safely resume operations.
Broader Impact
The recovery effort sets a precedent for handling bridge exploits through multi-protocol coordination, oracle adjustments, and DAO governance. It demonstrates how on-chain liquidation of attacker positions can help recover funds. Yet, the plan’s dependence on governance approvals and the risk of attacker interference highlight the fragility of such interventions. The incident may accelerate industry calls for stronger bridge security standards. With over $300 million at stake, the outcome will be closely watched.
What to Watch Next
- Monitor the Arbitrum DAO vote on releasing 30,765 ETH to DeFi United — a critical step in the recovery.
- Watch Aave and Compound for liquidation events as DeFi United executes its plan with adjusted oracle prices.
- Track attacker addresses; any movement could disrupt the recovery process.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
