On April 28, 2026, the recovery group DeFi United, in collaboration with Aave Labs, released a technical implementation plan to restore the backing of rsETH. The initiative follows the Kelp bridge exploit on April 18, which led to the unauthorized release of 116,500 rsETH on the Unichain network, valued at approximately 293 million USD at the time. The recovery document details a structured sequence of controlled liquidations and re-collateralization mechanisms to address the liquidity deficit in the impacted DeFi markets.
The core of the technical strategy involves the phased conversion of Ether (ETH) into rsETH to replenish the missing collateral. According to the announcement, the recovered funds will be deposited in stages into the affected bridge’s vault. This action aims to restore the necessary parity between locked assets and the tokens issued on Unichain, enabling the bridge to resume standard operations once the solvency threshold is met.
— Aave (@aave) April 28, 2026
As a preventive measure, LayerZero and Kelp have implemented additional security layers within the bridge infrastructure. These updates precede the full reopening and are designed to ensure that the lack of a corresponding burn on the source chain—the primary vector of the April 18 exploit—cannot be repeated. The execution of this plan depends on liquidity being injected in a fragmented manner to prevent price distortions for rsETH during the acquisition and deposit process.
Liquidation of attacker positions in Aave and Compound
DeFi United has identified seven wallet addresses linked to the attacker that currently maintain active positions in the Aave and Compound protocols. These addresses hold approximately 107,000 rsETH in collateral, representing the majority of the improperly released assets. The recovery plan establishes a temporary adjustment of the rsETH oracle price to facilitate controlled liquidations of these accounts without triggering a systemic insolvency cascade for other users.
The process involves lowering the collateral value within the oracle to trigger the protocols’ liquidation thresholds. Once activated, the recovered collateral will be transferred to a multi-signature wallet managed by DeFi United. This procedure is vital for platform stability, considering that algorithmic liquidity management in Aave prioritizes immediate asset availability over total deposited volume. Following the liquidation, the oracle will be reset to market values, and the recovered rsETH will be exchanged for ETH to cover financial deficits.
Such technical interventions are not unprecedented in scenarios of extreme volatility or security failures, similar to massive liquidations on Ethereum that have required rapid adjustments to risk parameters to protect the protocol.
Capital commitments and ecosystem governance
The viability of the technical plan is supported by a multi-channel funding structure involving institutional players and decentralized autonomous organizations (DAOs). On April 27, 2026, Consensys and Joe Lubin confirmed a commitment of up to 30,000 ETH to support the recovery efforts. This initiative was joined by Sharplink, a publicly-traded Ethereum treasury company, acting as a financial advisor to structure the distribution of these funds.
Simultaneously, Aave Labs submitted a formal proposal to the Arbitrum DAO, requesting the release of 30,765 ETH frozen by the Arbitrum Security Council immediately following the April 18 exploit. The objective is to transfer these assets directly to DeFi United’s custody to accelerate the restoration of the backing. As of Tuesday, the DeFi United official dashboard recorded a total of 302.26 million USD in committed capital, equivalent to 132,706.90 ETH.
However, a significant portion of these resources remains subject to governance processes. The final execution of the commitments depends on votes from the Arbitrum DAO and other involved protocols, as well as the validation of smart contracts that will manage the outflow of funds.
Limitations and risks of the execution process
Despite the technical robustness of the presented plan, full recovery of funds is contingent upon variables that DeFi United does not entirely control. The liquidation sequence requires that the attacker does not move the funds from the seven identified addresses before the oracle changes are implemented. Furthermore, any interruption in the governance voting process could delay the liquidity injection necessary to stabilize rsETH.
The recovery group has emphasized that the oracle changes are transitory and will be strictly limited to the attacker’s addresses to minimize impact on the secondary market. The success of the operation will be measured by the Kelp bridge’s ability to process native rsETH withdrawals without relying on external subsidies once the 100% backing is restored on Unichain.
This article is for informational purposes and does not constitute financial advice.
