Key Takeaways
- The rsETH attacker’s Arbitrum tokens were burned today, following liquidation of 8 Aave V3 positions on May 6.
- Aave co-founder Stani Kulechov confirmed ETH withdrawals will normalize within 24 hours of the Arbitrum burn step.
- Recovery is partially complicated by a U.S. court’s prior freeze on $71M in ETH, claimed to be linked to North Korea’s Lazarus Group.
MORE THAN AN EXPLOIT
The rsETH bridge lockbox on Arbitrum is being refilled, and ether withdrawals for users affected by the KelpDAO exploit are expected to start within 24 hours, marking the final phase of one of decentralized finance ( DeFi)’s most complex coordinated recoveries. Aave co-founder Stani Kulechov confirmed the development directly, noting the past several weeks, including weekends, had been “incredibly intense.”
The attack began on April 18, when an unknown attacker exploited KelpDAO’s Layerzero bridge (a cross-chain messaging system) and fraudulently minted 116,500 rsETH tokens without backing them with real assets.
The attacker then deposited roughly 89,500 of those tokens into Aave V3 as collateral and borrowed wrapped ether against them, generating over $190 million in undercollateralized positions and leaving Aave V3 potentially exposed to up to $230 million in losses. However, Aave’s community moved quickly, freezing rsETH markets on both Ethereum and Arbitrum to contain the damage.
LIQUIDATION AND BURNING
Recovery began in earnest on May 6, when the attacker’s eight positions on Aave V3 were liquidated across Ethereum and Arbitrum. As part of Phase II of the recovery plan, the liquidated rsETH on Arbitrum has now been burned, permanently removing the fraudulently minted tokens from circulation and restoring integrity to the rsETH supply. The rsETH bridge lockbox is being refilled to back the remaining supply at a 1:1 ratio against ether.
As Bitcoin.com News reported last week, a U.S. federal judge cleared the transfer of $71 million in recovered ETH to Aave as part of this final recovery phase, lifting a freeze that had been imposed after a U.S. law firm filed a restraining notice claiming the funds could be linked to the Lazarus Group, North Korea’s state-backed hacking unit.
With the Arbitrum burn complete and the lockbox being refilled, ether withdrawals for rsETH holders are expected to resume within 24 hours, per Kulechov’s latest update. ETH loan-to-value (LTV) ratios on Aave are already returning to normal, and liquidity is expected to normalize as the market absorbs the resumed withdrawals.
The coordinated response, across Aave governance, KelpDAO, and legal channels, witnessed in response to this entire episode has been one of the more complex multi-party recoveries the ecosystem has managed. And, even though the final loss tally remains unclear, the structural damage from unbacked rsETH minting has now been contained.
