Coalition Unveils Plan to Mitigate Aave Token Exploit

Unlike typical $300 million losses, this one may come with a repair plan. DeFi United, a coalition of multiple blockchain projects and crypto ecosystem individuals, has outlined a detailed, step-by-step proposal to restore rsETH backing following this month’s Kelp DAO hack, which released over 116,000 unaccounted-for tokens and disrupted DeFi lending markets. The proposal, shared on Aave’s official X account, resembles a coordinated recovery operation, relying heavily on Aave’s infrastructure to rectify the damage and stabilize markets. The incident began on April 18, when an attacker exploited an rsETH bridge vulnerability by forging a legitimate-looking message, tricking the Ethereum side into releasing 116,500 rsETH without actual backing. These tokens were not idle; they were spread across wallets and deployed in DeFi, with a significant portion used as collateral on Aave and other lending platforms, causing protocols like Aave to hold unbacked collateral. According to the proposal, most exploited funds remain active, with approximately 107,000 of the original 116,500 rsETH tied up in positions across Aave and Compound. DeFi United’s proposal aims to address both the rsETH backing restoration and the unwinding of loans created using those extra tokens simultaneously. To restore backing, the group has secured enough ETH commitments to fully re-collateralize rsETH, planning to feed that ETH back into the system in stages, converting it to rsETH and depositing it back into the system. The plan also involves carefully unwinding the lending market mess, including dealing with the attacker’s positions on Aave, which are essentially illegitimate loans backed by rsETH. By temporarily adjusting rsETH valuation, those bad positions can be closed more smoothly, recovering underlying assets like ETH. The process, although not risk-free, reflects a coordinated response, with the end goal of fully restoring rsETH backing and stabilizing affected markets.