DeFi United, the Aave-linked recovery group formed in response to the $293 million Kelp bridge exploit, has unveiled a detailed technical implementation plan to restore the backing of rsETH tokens. The exploit, which occurred on April 18, saw 116,500 rsETH released from the Kelp bridge without a corresponding burn on Unichain, creating a severe imbalance in the token's peg and causing turmoil across DeFi lending markets.
Understanding the rsETH exploit
rsETH is a liquid restaking token that represents staked Ether (ETH) and is used across multiple DeFi protocols, including Aave and Compound. The Kelp bridge, which facilitates the transfer of rsETH between chains, was compromised when an attacker manipulated the bridge's logic to withdraw 116,500 rsETH without destroying an equivalent amount on the source chain. This effectively minted new tokens out of thin air, flooding the market and causing the price of rsETH to deviate from its intended peg. The total value of the stolen rsETH was approximately $293 million at the time of the attack. The incident highlighted persistent vulnerabilities in cross-chain bridge infrastructure, which has been a target for hackers throughout 2025.
The recovery plan step by step
DeFi United's proposed plan is structured in several phases, each designed to gradually restore confidence in the rsETH market. The first step involves converting committed Ether (ETH) into rsETH in a series of tranches. This ETH has been pledged by various ecosystem participants, including Aave, LayerZero, and other protocols, totaling over $300 million as of late April. These newly minted rsETH tokens will be deposited into the affected bridge lockbox, allowing the bridge to resume normal operations once the backing is fully restored. However, before the bridge can go live, LayerZero and Kelp must implement additional security measures to prevent a repeat of the exploit.
In parallel, DeFi United plans to address the attacker-linked positions still active on Aave and Compound. According to the group, seven addresses associated with the exploiter continue to hold rsETH-backed loans, representing about 107,000 of the original 116,500 rsETH released. These positions are currently causing market impairments, as the flooded supply suppresses the token price and disrupts lending protocols. To clear them, the plan proposes a temporary adjustment of the rsETH oracle price to enable controlled liquidations. This is a delicate procedure, as any misstep could trigger a cascade of bad debt. Once the positions are liquidated, the recovered collateral will be transferred to a DeFi United multisig wallet. After that, the oracle will be restored to its normal pricing, the liquidated rsETH will be redeemed for ETH, and the resulting funds will be used to cover any deficits left in the affected protocols.
Governance and funding commitments
The success of the recovery plan depends heavily on governance approvals from multiple DAOs. On April 21, Aave Labs formally requested that the Arbitrum DAO release 30,765 ETH that had been frozen by the Arbitrum Security Council after the exploit. These funds are earmarked for DeFi United's recovery pool. Additionally, Ethereum co-founder Joe Lubin and his company Consensys have joined the effort with a commitment of up to 30,000 ETH. Sharplink, a publicly traded Ethereum treasury firm, is also contributing in an advisory capacity to help structure the financial mechanics of the recovery. As of April 22, the DeFi United dashboard showed $302.26 million in total commitments, equivalent to 132,706.903 ETH. However, a portion of these commitments remains contingent upon successful DAO votes and final execution agreements.
The draft plan also requires temporary changes to the rsETH oracle, which is governed by the Aave community. Aave token holders will need to vote on a proposal to allow a limited-time deviation from the market price to facilitate the liquidation without causing further market disruption. Similar votes may be needed on Compound, depending on how the positions are distributed. The entire process is designed to minimize losses for legitimate users while removing the exploiter's influence from the protocols.
Broader implications for DeFi
The Kelp exploit is one of the largest DeFi attacks of the year, and the response by DeFi United represents a coordinated effort by major players to stabilize the ecosystem. The incident underscores the importance of rigorous bridge security and the need for rapid, transparent recovery mechanisms. In the past, similar events—such as the Ronin and Wormhole hacks—led to months of uncertainty and losses for users. By contrast, DeFi United's proactive approach, with public commitments and a detailed technical plan, aims to restore trust quickly. However, the plan is not without risks. If the attacker were to front-run the liquidation steps or manipulate the oracle adjustment, the recovery could stall. Furthermore, the reliance on DAO votes means that execution timelines are uncertain.
The rsETH saga also highlights the growing complexity of DeFi protocols, where a single exploit can cascade across multiple platforms. Aave, Compound, and Unichain are all affected, and the recovery effort requires coordination among disparate governance bodies. The involvement of LayerZero, a leading interoperability protocol, adds another layer of technical oversight. These cross-chain dependencies are becoming increasingly common as DeFi expands, and the industry is learning to build better response frameworks.
As the technical implementation moves forward, all eyes are on the governance votes that will determine whether the pledged funds become operational. The Arbitrum DAO is expected to decide on the release of frozen ETH within the next week. Meanwhile, the DeFi United multisig team is preparing to execute the first tranche of rsETH minting as soon as the security upgrades are verified. The broader crypto community is watching closely, as the outcome could set a precedent for how future bridge exploits are managed.
Source: Cointelegraph News