Aave Labs has liquidated the Kelp DAO attacker’s remaining rsETH positions on Ethereum and Arbitrum, moving one step closer to fully restoring rsETH backing and compensating affected users.
This marks a “critical step” in the “DeFi United” recovery plan, Aave posted on X on Wednesday. It added that the liquidated collateral tied to the $293 million exploit on April 18 was transferred to Recovery Guardian, a multisignature wallet managed by DeFi United.
DeFi United is now only about 10% short of the Ether (ETH) needed to restore the Kelp DAO restaked ETH (rsETH) token, according to Thaddeus Pinakiewicz, vice president of Galaxy Digital’s research team.
The Kelp DAO exploit has been one of the most devastating crypto hacks in 2026, causing a ripple effect throughout the DeFi lending market that disrupted billions of dollars in liquidity and eroded confidence across the ecosystem.
Aave said user funds weren’t affected by the liquidations and that Aave’s insurance mechanism to provide automated protection against bad debt — Umbrella — wasn’t used.
Source: Aave
Aave said on April 28 that clearing up the hacker’s collateral on Ethereum and Arbitrum would release 13,000 Ether worth nearly $30.2 million at current prices.
Pinakiewicz, however, noted that there is another 30,765 ETH frozen by Arbitrum DAO that is in “legal limbo” after US law firm, Gerstein Harrow LLP, filed a restraining notice on Friday to prevent Arbitrum DAO from redistributing the frozen ETH. In response, Aave filed an emergency motion to vacate that restraining notice.
Meanwhile, members of Arbitrum DAO are still voting on whether to release the frozen ETH to the DeFi United fund, with over 90% of voters in favor of the proposal. Voting is set to close on Friday.
Related: Three reasons why Ether price rallies fizzle near $2.4K
DeFi United is also awaiting commitments from stablecoin issuers Circle, Ethena and Frax, as well as Kraken-built Ethereum layer 2 Ink.
Aave needs these commitments to “get it over the line and plug the hole,” Pinakiewicz said.
Aave’s TVL bleeding has stopped
Aave was hit hard by the Kelp DAO exploit, with its total value locked falling by nearly $12 billion in a week after the hacker put the stolen rsETH tokens up as collateral on its lending platform to borrow wrapped Ether, leaving more than $190 million in bad debt and triggering a wave of withdrawals.
DefiLlama data shows that net outflows from Aave’s lending markets have eased over the past week, with the protocol’s total value locked increasing from a local low of $14.2 billion on April 26 to back above the $15 billion mark.
Aave’s change in TVL in 2026. Source: DefiLlama
Magazine: AI-driven hacks could kill DeFi — unless projects act now
