Catenaa, Monday, May 04, 2026- A coalition of decentralized finance participants under DeFi United has outlined a plan to restore full backing for rsETH after a $292 million exploit hit Kelp DAO earlier this month, with funds raised and recovery steps now moving toward execution pending approvals.
Exploit Fallout
The April 18 attack targeted the rsETH bridge using a forged message. The breach allowed the attacker to mint about 116,500 unbacked tokens.
Roughly 107,000 rsETH moved into lending positions on Aave. This created large-scale bad debt across affected markets.
The exploit has been widely linked by analysts to the Lazarus Group. The group has been tied to several major crypto attacks in recent years.
Recovery Plan
DeFi United raised more than $300 million in ether through contributions from multiple protocols. The funding pool is set to support the restoration effort.
The plan converts committed ETH into rsETH in phases. These tranches will be transferred into a lockbox contract to restore backing.
The process depends on governance approvals and finalized agreements. Execution timelines remain subject to coordination across participating protocols.
Debt Resolution
The recovery effort includes clearing eight affected positions on Aave across Ethereum and Arbitrum markets. This step is needed to recover about 13,000 ETH.
A controlled liquidation process will temporarily adjust the rsETH oracle price. This allows positions to be liquidated in a structured sequence.
Liquidated collateral will move into a multisig wallet controlled by DeFi United. Assets will then be redeemed and used to cover deficits.
Compound is expected to follow a similar path. Its process could recover about 16,776 ETH tied to the exploit.
Risk Factors
The recovery plan carries execution risks during the approval phase. The attacker may attempt to interfere before the process is completed.
Incomplete liquidation could leave residual deficits. Additional steps may be required if disruption occurs during execution.
Security upgrades on LayerZero and Kelp DAO are still being deployed. These systems have not yet been fully tested in live conditions.
To limit exposure, the ETH conversion and deposits will take place in stages. This approach is designed to reduce risk during restoration.
Market Impact
The coordinated response highlights how DeFi protocols act collectively during crises. Shared funding pools are emerging as a defense mechanism against systemic shocks.
Restoring rsETH backing without spreading losses across users remains a central objective. This approach seeks to maintain confidence in lending markets.
The outcome may influence how future exploits are handled. Protocol coordination could become a standard response model.
Kelp DAO operates within the liquid restaking sector, where users deposit ether and receive derivative tokens such as rsETH. These tokens are used across DeFi platforms for lending and yield strategies.
Bridges connecting ecosystems remain a frequent target for attacks due to their complexity. Message validation failures have been a recurring weakness in past exploits.
Aave and Compound are among the largest decentralized lending platforms, with billions in total value locked. Disruptions on these platforms can ripple across the wider DeFi market.
The Lazarus Group has been linked by security firms to multiple large crypto thefts. These incidents have pushed protocols to improve safeguards while testing recovery frameworks under real conditions.
