Coalition Unveils Plan to Mitigate $300 Million Token Exploit Impact on Aave Users

The aftermath of a $300 million exploit doesn't typically come with a clear repair guide, but DeFi United is attempting to change that. Following the Kelp DAO hack, which released over 116,000 unaccounted-for tokens and caused significant disruption to lending markets, the group has outlined a step-by-step proposal to restore rsETH's backing. The plan, shared on Aave's official X account, resembles a coordinated effort, leveraging Aave's infrastructure to rectify the damage and stabilize markets. The issue originated on April 18 when an attacker exploited a vulnerability in rsETH's bridge, creating 116,500 rsETH without backing by tricking the Ethereum side into releasing funds that hadn't actually moved. These tokens were then dispersed across multiple wallets and utilized as collateral on Aave and other lending platforms, causing protocols to hold collateral that was temporarily under-backed. According to the proposal, the majority of the exploited funds remain active, with around 107,000 of the original 116,500 rsETH still tied up in positions across Aave and Compound. To address this, DeFi United's proposal aims to restore rsETH's backing and unwind the loans created using the extra tokens simultaneously. The group claims to have secured enough ETH commitments to fully re-collateralize rsETH, planning to feed the ETH back into the system in stages. At the same time, the proposal focuses on the lending markets where the damage is most visible, intending to carefully unwind the mess rather than letting it play out chaotically. A key part of this involves dealing with the positions the attacker opened on Aave, which are essentially loans backed by rsETH that shouldn't have existed. Instead of waiting for these loans to collapse, the proposal suggests temporarily adjusting rsETH's valuation to enable these bad positions to be liquidated or closed more smoothly. As these positions are unwound, the underlying assets can be recovered, potentially freeing up around 13,000 ETH from Aave alone. This collateral can then be converted into ETH and used to cover the shortfall created by the exploit. While the process carries risks, including the need for governance approvals and the successful deployment of committed funds, the plan represents a more coordinated response than DeFi has often managed. If executed successfully, the goal is to fully restore rsETH's backing and stabilize all affected markets.