Ether withdrawals are expected to resume within 24 hours for KelpDAO users after a coordinated burn of the attacker’s rsETH tokens on Arbitrum successfully neutralized the exploit’s impact.
MORE THAN AN EXPLOITThe attacker then deposited roughly 89,500 of those tokens into Aave V3 as collateral and borrowed wrapped ether against them, generating over $190 million in undercollateralized positions and leaving Aave V3 potentially exposed to up to $230 million in losses. However, Aave’s community moved quickly, freezing rsETH markets on both Ethereum and Arbitrum to contain the damage.
LIQUIDATION AND BURNINGRecovery began in earnest on May 6, when the attacker’s eight positions on Aave V3 were liquidated across Ethereum and Arbitrum. As part of Phase II of the recovery plan, the liquidated rsETH on Arbitrum has now been burned, permanently removing the fraudulently minted tokens from circulation and restoring integrity to the rsETH supply. The rsETH bridge lockbox is being refilled to back the remaining supply at a 1:1 ratio against ether.
The coordinated response, across Aave governance, KelpDAO, and legal channels, witnessed in response to this entire episode has been one of the more complex multi-party recoveries the ecosystem has managed. And, even though the final loss tally remains unclear, the structural damage from unbacked rsETH minting has now been contained.
