Coalition Unveils Plan to Mitigate $300 Million Token Exploit Affecting Aave Users

Unlike typical massive financial losses, the group leading the recovery effort from the Kelp DAO hack is attempting to devise a structured repair plan. DeFi United, comprising multiple blockchain projects and individuals from the crypto ecosystem, has outlined a step-by-step proposal to reinstate the backing of rsETH. This follows the recent hack that sent shockwaves through lending markets after over 116,000 unaccounted-for tokens were released. The plan, shared on Aave's official X account, resembles a coordinated operation, heavily reliant on Aave's infrastructure to rectify the damage and restore market stability. The incident began on April 18 when an attacker exploited a vulnerability in rsETH's bridge, creating 116,500 rsETH without backing by tricking the system into believing funds had moved. These tokens were then distributed across multiple wallets and utilized in DeFi, primarily as collateral on lending platforms like Aave. This created a systemic issue where protocols held collateral that was temporarily under-backed. According to the proposal, most of the exploited funds remain active, with approximately 107,000 of the original 116,500 rsETH tied up in positions across Aave and Compound. DeFi United's proposal aims to address two key issues: restoring rsETH's backing and unwinding the loans created with the exploited tokens. To achieve this, the group has secured enough ETH commitments to fully re-collateralize rsETH and plans to introduce this ETH into the system in stages, converting it to rsETH to ensure the token is fully backed. Simultaneously, the proposal focuses on the lending markets where the damage is most evident, suggesting a controlled unwinding of the affected positions. This involves dealing with the attacker's positions on Aave, which are essentially loans backed by rsETH that should not have existed. Rather than allowing these loans to collapse and potentially causing further market disruption, the proposal recommends temporarily adjusting rsETH's valuation within the system to enable the smooth liquidation or closure of these positions. As these positions are unwound, the underlying assets, such as ETH, can be recovered, potentially freeing up around 13,000 ETH from Aave alone. This collateral will then be converted into ETH and used to cover the shortfall created by the exploit, effectively filling the gap left behind. While the process carries risks, including the need for governance approvals across multiple chains and the successful deployment of committed funds, it represents a more coordinated response than what DeFi has typically managed. The ultimate goal, as stated in the proposal, is to fully restore rsETH's backing and stabilize all affected markets.