KelpDAO, Aave Burn rsETH on Arbitrum; ETH Withdrawals to Resume

KelpDAO and Aave burned attacker-held rsETH on Arbitrum, refilled the rsETH bridge lockbox and confirmed ether withdrawals for users affected by the April 18 exploit will resume within 24 hours. Aave co-founder Stani Kulechov wrote that withdrawals would “normalize within 24 hours” and described recent weeks as “incredibly intense.”

The exploit began on April 18 when an unknown actor used a vulnerability in the LayerZero bridge used by KelpDAO to mint 116,500 rsETH tokens without ether backing. The attacker deposited roughly 89,500 of those tokens into Aave V3 as collateral and borrowed wrapped ether, creating more than $190 million in undercollateralized loans and exposing Aave V3 to as much as $230 million in potential losses. Aave governance froze rsETH markets on Ethereum and Arbitrum after the incident.

Recovery activity accelerated on May 6, when eight attacker positions on Aave V3 were liquidated across Ethereum and Arbitrum. The rsETH recovered on Arbitrum was burned, permanently removing that portion of the fraudulently minted supply from circulation. KelpDAO and Aave have been refilling the bridge lockbox to restore a 1:1 backing of rsETH against ether.

A U.S. federal judge cleared the transfer of $71 million in recovered ETH to Aave after a prior court freeze that followed a restraining notice alleging a link between the funds and North Korea’s Lazarus Group. The court clearance allowed recovered funds to be used in the final phase of the recovery plan.

Aave reported that ETH loan-to-value ratios on its platform have begun returning to normal levels. Market liquidity is expected to stabilize as withdrawals resume and affected users reclaim ether. Aave governance, KelpDAO and legal teams coordinated the liquidations, market freezes, token burn and lockbox refilling. The final loss total remains under review.