Aave founder Stani Kulechov published a technical implementation plan on April 28 to restore rsETH backing, with execution steps set to start within days. The recovery has two tracks running at the same time: rebuilding rsETH’s nominal 1.07 ETH backing ratio through staged ETH deposits, and clearing eight affected positions on Aave to recover excess collateral.
A single looping trade concentrated most of the exposure
The chain of events began with the April 18 exploit of rsETH’s bridge route from Unichain to Ethereum. According to the plan, a forged inbound packet was verified on Ethereum without a matching burn on Unichain, which led to the release of 116,500 rsETH from the Ethereum-side adapter.
The stolen assets were then spread across several addresses. A large share was posted as collateral on Aave V3 on Ethereum, another portion was bridged to Arbitrum to open positions on Aave there, and the rest moved through other venues. Post-incident analysis found that 98% of rsETH collateral on Aave had been concentrated in a single looping trade, exposing a structural weakness that magnified the damage across the platform.
Seven addresses linked to the exploiter still hold active rsETH-backed positions on Aave and Compound, representing roughly 107,000 rsETH out of the original 116,500 taken in the exploit. Cryptoquant analysts described the fallout as the worst DeFi liquidity crunch since 2024.
ETH commitments will be converted in tranches
For rsETH to return to normal market operation, its backing has to be restored to the nominal Kelp rsETH exchange ratio of 1.07 ETH. Defi United said it has already secured the ETH commitments needed for that target, though final execution still depends on governance approvals and completion of definitive agreements.
Under the plan, committed ETH will be converted into rsETH in tranches and deposited into the bridge lockbox contract. The staged structure is meant to manage execution risk. Layerzero and Kelp have also added extra security measures before bridge activity resumes, but the plan notes that residual risk remains until those protections are tested in production.
Temporary oracle changes are part of the liquidation sequence
The second track focuses on clearing eight affected positions across Aave’s Ethereum Core and Arbitrum markets. That process requires governance proposals to pass and execute on both networks. The mechanism includes a temporary adjustment to the rsETH oracle price so liquidation can proceed more efficiently, creating a controlled deficit that would later be closed with ETH recovered from redeemed rsETH collateral.
The document says all configuration changes are temporary and will be fully reversed after the process is complete, leaving no lasting modification to the Aave protocol. This path is aimed at recovering about 13,000 ETH now locked inside the Aave positions.
Compound joins Defi United’s coordinated response
Compound is running a parallel clearance of the exploiter’s position together with Defi United and is supplying the liquidity required for that process. The plan estimates that an additional 16,776 ETH could be recovered on the Compound side. With Compound now included, the cross-protocol coalition has grown into one of the broadest coordinated responses to a DeFi exploit in recent memory.
Execution still carries governance risk. The exploiter continues to hold active positions on both Ethereum and Arbitrum, and any deliberate interference could complicate the liquidation sequence and force extra steps. Defi United said the structure is designed to restore rsETH backing without socializing losses, but that outcome depends on clean execution across governance and liquidation stages.