DeFi United has raised over $300 million in ETH to cover the $292 million Kelp DAO exploit. The Aave-led coalition of crypto protocols published its technical restoration plan this week. It outlines how DeFi United will restore rsETH and eliminate the bad debt spread across affected lending markets.
How the Kelp DAO rsETH exploit worked
On April 18, attackers attributed to North Korea’s Lazarus Group targeted Kelp DAO’s rsETH bridge. rsETH is a liquid restaking token issued by Kelp DAO — widely used as collateral across DeFi protocols. A forged inbound message tricked the Ethereum side of the bridge into releasing 116,500 rsETH tokens. No corresponding burn happened on Unichain, creating 116,500 unbacked tokens from nothing.
The attacker spread those tokens across multiple wallets, then deposited them as collateral on Aave and Compound to borrow real ETH. About 107,000 rsETH ended up in active lending positions on both protocols, leaving substantial bad debt behind. USDT and USDC utilization on Aave hit close to 100% for several days, effectively locking users out of withdrawals.
How DeFi United plans to restore rsETH
DeFi United formed in the days after the exploit as a cross-protocol response. The coalition has since secured 132,650 ETH in commitments, worth roughly $303 million at current prices. Consensys contributed 30,000 ETH alone, and the Avalanche Foundation has also pledged support. Justin Sun separately supplied $20 million in USDT on Aave to ease the liquidity pressure. Mantle, Ether.Fi, Lido, and others are still finalizing their governance votes before the plan can execute.
The restoration runs on two parallel tracks. The first converts the committed ETH into rsETH in tranches and deposits it into the bridge lockbox. That restores rsETH’s full backing and allows the bridge to reopen. Both LayerZero and Kelp DAO have added new security measures ahead of that reopening.
The second track clears the eight attacker-held positions still open on Aave’s Ethereum and Arbitrum markets. A controlled liquidation sequence will temporarily adjust the rsETH oracle price to push through the liquidations. Kelp then redeems the recovered rsETH for ETH through its standard procedure. That ETH covers any deficit on Aave’s books. Compound will run a similar process, recovering approximately 16,776 ETH. Once both tracks complete, DeFi United will unfreeze rsETH and ETH across all affected markets.
Risks to DeFi United’s recovery plan
The plan depends on governance proposals passing correctly on Ethereum and Arbitrum. The attacker still has a window to interfere before that happens. DeFi United warned that deliberate disruption could leave positions only partially resolved. Arbitrum’s security council has separately frozen 30,766 ETH linked to the attacker. A governance proposal to direct those funds to DeFi United is also moving forward, though the process could take 49 days.
Security upgrades on LayerZero and Kelp’s bridge are still in production and untested under live conditions. That is part of why DeFi United stages the ETH-to-rsETH conversion in tranches rather than all at once.
Still, the response is significant. By most accounts, this is the largest DeFi hack in history. Even so, dozens of competing protocols pooled hundreds of millions to protect users across the broader ecosystem. If the plan executes cleanly, it would rank as one of the most coordinated recovery efforts DeFi has ever produced. This will be a true test of whether decentralized finance can self-organize under pressure.
