Major DeFi Player Aave Seizes Assets of Kelp DAO Hacker, Recouping Nearly $300 Million in Ongoing Crackdown

Table of Contents The lending protocol Aave has successfully liquidated all remaining rsETH collateral positions connected to the Kelp DAO exploiter across both the Ethereum mainnet and Arbitrum network. This action represents a significant milestone in the DeFi United community-led initiative aimed at restoring rsETH’s proper backing and compensating affected users. In line with the technical plan outlined below, the attacker's rsETH positions on Aave have been liquidated on Ethereum and Arbitrum. The liquidated collateral now sits with the Recovery Guardian as specified in the AIP. No other users were affected, and Umbrella was also… https://t.co/GQxroGuME0 — Aave (@aave) May 6, 2026 All liquidated assets have been routed to the Recovery Guardian wallet, a multisignature address under DeFi United’s control. Aave emphasized that the liquidation process did not impact any user deposits and was completed without activating its Umbrella insurance protection. The exploitation occurred on April 18 when an attacker—believed to have connections to North Korean threat actors—exploited vulnerabilities in Kelp DAO’s LayerZero-based bridge infrastructure. This allowed the malicious actor to illegitimately create 116,500 rsETH tokens on Ethereum without proper backing. These fraudulent tokens were subsequently deployed as collateral on decentralized lending protocols like Aave and Compound to extract wrapped Ether. The security breach saddled Aave with over $190 million in uncollateralized debt and sparked significant capital flight from the platform. In the seven days after the incident, the protocol witnessed its total value locked plummet by approximately $12 billion. To enable the liquidations, Aave’s governance community approved a temporary modification to the rsETH price oracle. This adjustment created an undercollateralized state in the attacker’s borrowed positions, triggering the liquidation mechanism. The oracle configuration has since returned to standard operating parameters. DeFi United’s recovery fund has accumulated more than $320 million in contributions. Galaxy Digital’s vice president of research, Thaddeus Pinakiewicz, indicated that the fund requires approximately 10% additional ETH to completely resolve the backing deficit. A separate complication has emerged that threatens to delay the recovery timeline. Following Arbitrum DAO’s decision to freeze 30,765 ETH linked to the attack for transfer to DeFi United, Gerstein Harrow LLP—a United States law firm—submitted a restraining notice last Friday aimed at preventing the transfer. The legal firm seeks to claim the frozen Ethereum as restitution connected to terrorism-related court judgments against North Korea. Aave has responded by filing an emergency motion requesting the court to dismiss the restraining notice. Arbitrum DAO token holders continue to deliberate on whether to authorize the release of these funds to DeFi United, with more than 90% of voting participants supporting the transfer. The governance vote is set to conclude this Friday. DeFi United remains in discussions with several major crypto entities awaiting formal pledges. These include stablecoin issuers Circle, Ethena, and Frax, as well as Ink, the Ethereum layer-2 network developed by Kraken. Pinakiewicz said these commitments are needed to “get it over the line and plug the hole.” Aave’s total value locked has demonstrated signs of recovery. According to DefiLlama analytics, the protocol has rebounded from its April 26 low of $14.2 billion to exceed $15 billion in recent trading sessions. Outflows from Aave’s lending markets have moderated during the past week. Friday’s conclusion of the Arbitrum DAO governance vote will serve as a critical juncture in determining whether the restoration initiative can achieve its objectives.