Key Takeaways:
- The recovery runs two parallel tracks, i.e., restoring rsETH’s nominal 1.07 ETH backing ratio through tranched ETH deposits, and clearing eight Aave positions.
- Post-exploit analysis found that 98% of rsETH collateral on Aave was concentrated in a single looping trade, a structural vulnerability that amplified the damage across the platform.
- Defi United’s cross-protocol recovery coalition now includes Compound, marking the broadest coordinated response to a decentralized finance exploit in recent memory.
Single Looping Trade Left Aave Exposed
The April 18 exploit targeted rsETH’s bridge on the Unichain-to-Ethereum route. A forged inbound packet was verified on the Ethereum side without a corresponding burn on Unichain, causing 116,500 rsETH to be released from the Ethereum-side adapter.
The stolen funds were subsequently distributed across multiple addresses, with a significant portion deposited as collateral on Aave V3 on Ethereum and another portion bridged to Arbitrum to open positions on Aave there. The remaining funds were routed through other venues.
The incident triggered what Cryptoquant analysts described as the worst decentralized finance ( Defi) liquidity crunch since 2024.
Seven addresses linked to the exploiter currently hold active rsETH-backed positions across Aave and Compound, representing approximately 107,000 rsETH of the original 116,500 stolen. Defi United’s plan runs on two parallel tracks, the first being restoring rsETH’s backing ratio and then clearing the affected positions to recover the excess collateral.
Restoring the 1.07 ETH Backing Ratio
For rsETH to resume normal market operations, its backing must be restored to its nominal Kelp rsETH exchange ratio of 1.07 ETH. Defi United has secured the ETH commitments required to achieve this, with final execution subject to governance approvals and completion of definitive agreements.
The restoration process converts committed ETH into rsETH in tranches, a deliberate risk-management structure, before depositing it into the bridge lockbox contract. Both Layerzero and Kelp have implemented additional security measures ahead of bridge resumption, though the plan notes residual risk remains until those measures are validated in production.
Controlled Liquidation to Clear Exploiter Positions
Clearing eight affected positions across Aave’s Ethereum Core and Arbitrum markets requires governance proposals to pass and execute on both networks. The mechanism temporarily adjusts the rsETH oracle price to enable efficient liquidation, generating a controlled deficit that is subsequently cleared using ETH recovered from the redeemed rsETH collateral. All configuration adjustments are temporary and fully reverted after completion, with no persistent changes to the Aave protocol.
This track targets the recovery of approximately 13,000 ETH currently locked in Aave positions. Compound is running a parallel clearance of the exploiter’s position with Defi United, providing the necessary liquidity, a process expected to recover a further 16,776 ETH on that side.
That said, execution carries governance risk as deliberate interference by the exploiter, who retains active positions on both Ethereum and Arbitrum, could complicate the liquidation sequence and require additional steps. Defi United has structured the plan to restore rsETH backing without socializing losses, though that outcome depends on clean execution across all governance and liquidation steps.
