Aave Strikes Back: Massive Liquidation Targets Kelp DAO Hacker’s rsETH Across Ethereum and Arbitrum

Ever wonder what it takes to claw back from a $293 million crypto heist and still keep your cool? Well, Aave Labs just liquidated the Kelp DAO attacker’s leftover rsETH positions on Ethereum and Arbitrum, inching closer to restoring full backing for rsETH and making things right for the folks affected. This isn’t just a routine clean-up—it’s a pivotal move in the “DeFi United” recovery game plan, and believe me, it’s a big deal in the wild world of DeFi hacks that has shaken the market to its core. With DeFi United nearly 90% of the way to reclaiming the needed Ether, the drama isn’t over yet: legal tangles, frozen funds, and community votes still play their parts in this unfolding saga. So the question is—can the recovery really plug this massive hole before jitters cause more ripple effects? Let’s dive into how Aave balances on this tightrope, keeping user funds safe without pulling the insurance trigger, all while its Total Value Locked shows signs of healing. Curious to see how this high-stakes recovery pans out? LEARN MORE.

Aave Labs has liquidated the Kelp DAO attacker’s remaining rsETH positions on Ethereum and Arbitrum, moving one step closer to fully restoring rsETH backing and compensating affected users.

This marks a “critical step” in the “DeFi United” recovery plan, Aave posted on X on Wednesday. It added that the liquidated collateral tied to the $293 million exploit on April 18 was transferred to Recovery Guardian, a multisignature wallet managed by DeFi United.

DeFi United is now only about 10% short of the Ether (ETH) needed to restore the Kelp DAO restaked ETH (rsETH) token, according to Thaddeus Pinakiewicz, vice president of Galaxy Digital’s research team.

The Kelp DAO exploit has been one of the most devastating crypto hacks in 2026, causing a ripple effect throughout the DeFi lending market that disrupted billions of dollars in liquidity and eroded confidence across the ecosystem.

Aave said user funds weren’t affected by the liquidations and that Aave’s insurance mechanism to provide automated protection against bad debt — Umbrella — wasn’t used.

Source: Aave

Aave said on April 28 that clearing up the hacker’s collateral on Ethereum and Arbitrum would release 13,000 Ether worth nearly $30.2 million at current prices.

Pinakiewicz, however, noted that there is another 30,765 ETH frozen by Arbitrum DAO that is in “legal limbo” after US law firm, Gerstein Harrow LLP, filed a restraining notice on Friday to prevent Arbitrum DAO from redistributing the frozen ETH. In response, Aave filed an emergency motion to vacate that restraining notice.

Meanwhile, members of Arbitrum DAO are still voting on whether to release the frozen ETH to the DeFi United fund, with over 90% of voters in favor of the proposal. Voting set to close on Friday.

DeFi United is also awaiting commitments from stablecoin issuers Circle, Ethena and Frax, as well as Kraken-built Ethereum layer 2 Ink.

Aave needs these commitments to “get it over the line and plug the hole,” Pinakiewicz said.

Aave’s TVL bleeding has stopped

Aave was hit hard by the Kelp DAO exploit, with its total value locked falling by nearly $12 billion in a week after the hacker put the stolen rsETH tokens up as collateral on its lending platform to borrow wrapped Ether, leaving more than $190 million in bad debt and triggering a wave of withdrawals.

DefiLlama data shows that net outflows from Aave’s lending markets have eased over the past week, with the protocol’s total value locked increasing from a local low of $14.2 billion on April 26 to back above the $15 billion mark.

Aave’s change in TVL in 2026. Source: DefiLlama

Magazine: AI-driven hacks could kill DeFi — unless projects act now

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.