Coalition Unveils Plan to Mitigate Aave Token Exploit

Unlike typical $300 million losses, this incident may have a structured recovery plan. DeFi United, a coalition of blockchain projects and crypto ecosystem individuals, has outlined a detailed strategy to revive the backing of rsETH following the Kelp DAO hack, which sent shockwaves through lending markets after releasing over 116,000 unaccounted tokens. The proposal, shared on Aave's official X account, resembles a coordinated cleanup effort, relying heavily on Aave's infrastructure to rectify the damage and stabilize markets. The incident originated on April 18, when an attacker exploited a vulnerability in rsETH's bridge, forging a message that appeared legitimate and tricking the Ethereum side into releasing 116,500 rsETH, creating a large batch of tokens without backing. These tokens were circulated across multiple wallets and deployed in DeFi, with a significant portion used as collateral on Aave and other lending platforms, making the issue systemic as protocols like Aave found themselves holding unbacked collateral. According to the proposal, most of the exploited funds remain active, with roughly 107,000 of the original 116,500 rsETH still tied up in positions across Aave and Compound. DeFi United's proposal addresses both the restoration of rsETH's backing and the unwinding of loans created with the extra tokens. To re-collateralize rsETH, the group has secured enough ETH commitments and plans to feed it back into the system in stages, converting it to rsETH and depositing it to ensure the token is fully backed. Simultaneously, the plan focuses on the lending markets where the damage is most visible, aiming to carefully unwind the mess instead of letting it play out chaotically. A key part involves dealing with the attacker's positions on Aave, which are essentially loans backed by rsETH that should not have existed. Rather than waiting for these loans to collapse, the proposal suggests temporarily adjusting rsETH's valuation to enable smoother liquidation or closure of these positions. As these positions are unwound, the underlying assets can be recovered, with the proposal estimating this could free up around 13,000 ETH from Aave alone, which can then be converted into ETH to cover the exploit's shortfall. The process is not without risk, relying on governance approvals, successful fund deployment, and smooth execution. However, the plan represents a more coordinated response than DeFi has previously managed, with the ultimate goal of fully restoring rsETH's backing and stabilizing affected markets.