Aave, Defi United to Restore rsETH, Unwind Exploit Positions

Aave and Defi United published a technical plan on Tuesday to restore rsETH to a 1.07 ETH backing and to unwind exploiter positions on Aave and Compound. Execution is scheduled to begin within days, subject to governance approvals on multiple networks.

The plan runs two parallel tracks: tranched ETH deposits to rebuild rsETH’s backing, and controlled liquidations to clear affected positions on Aave and Compound. Defi United raised 132,650 ETH required to restore the backing ratio, contingent on final agreements and passed proposals.

Aave founder Stani Kulechov released the implementation sequence. The recovery requires temporary contract and oracle adjustments to enable the liquidation operations and bridge resumption across the involved chains.

On the restoration track, committed ETH will be converted into rsETH in a series of tranches and deposited into the bridge lockbox contract. LayerZero and Kelp implemented additional security controls before the bridge resumes. The plan states residual risk remains until those measures are validated in production.

The clearance track targets eight affected Aave positions across Ethereum mainnet and Arbitrum. To enable efficient liquidations, the plan temporarily adjusts the rsETH oracle price, creating a controlled deficit that will be covered by ETH reclaimed from redeemed rsETH collateral. All configuration changes are described as temporary and will be reverted after the liquidation sequence completes.

Aave-side operations aim to recover about 13,000 ETH. Defi United coordinated with Compound on a parallel clearance expected to recover roughly 16,776 ETH on that protocol.

The incident began with an April 18 exploit of the Unichain-to-Ethereum rsETH bridge. A forged inbound packet on Ethereum was accepted without a corresponding burn on Unichain, releasing 116,500 rsETH from the Ethereum-side adapter. The stolen tokens were split across multiple addresses: a large portion was posted as collateral on Aave V3 on Ethereum, some were bridged to Arbitrum to open positions there, and the remainder moved through other venues. Seven addresses linked to the exploiter currently hold active rsETH-backed positions representing about 107,000 of the original 116,500 rsETH.

Post-exploit analysis found roughly 98% of rsETH collateral on Aave concentrated in a single looping trade, a structural exposure that amplified liquidations and losses across the platform.

The recovery plan carries governance and execution risks. The exploiter still holds active positions on Ethereum and Arbitrum and could interfere with liquidation sequences, which might require additional steps. Defi United structured the process to restore backing without socializing losses, but the outcome depends on successful governance votes, contract actions and liquidation mechanics across the involved networks.

rsETH is a protocol token that trades against ETH at a Kelp exchange ratio of 1.07 ETH. The coordinated response involves multiple protocol teams and external liquidity commitments and represents a broad cross-protocol recovery effort in decentralized finance.