Aave and Kelp burned the scalper’s rsETH holdings on Arbitrum on May 12, Aave said in an X post, confirming the completion of the first phase of the technical recovery plan.
The first set of steps in the rsETH technical recovery plan have been completed, including burning the exploiter’s rsETH on Arbitrum. The LayerZero OFT converter will gradually refill and rsETH operations will reopen over the coming days. https://t.co/p1tiIzp5Nr
– Avi (@avi) May 12, 2026
This action removes the last unsupported rsETH from circulation following the April 18 LayerZero bridge exploit that drained $292 million from the protocol.
The attack involved 116,500 unbacked rsETH minted through a vulnerability in Kelp’s LayerZero-powered bridge between Unichain and Ethereum, according to The incident report was posted on the Aave administration forum.
The path is based on a 1-of-1 validator configuration, meaning that the approval of a single validator was sufficient to validate cross-chain transfers. The attacker forged a message that falsely indicated that rsETH had been burned on the source chain, resulting in unsupported tokens being released on Ethereum.
These tokens were then deposited on Aave V3 marketplaces as collateral, allowing the attacker to borrow between $190 million and $236 million in WETH and wstETH.
What completes stage 1
DeFi United, the coalition formed to address the exploit, has raised over $327 million in ETH liabilities to restore rsETH support without spreading losses.
Contributors include Lido (2,500 ETH), EtherFi (5,000 ETH), LayerZero (10,000 ETH), Ethena, Mantle, Golem (1,000 ETH), and Aave founder Stani Kulechov personally (5,000 ETH).
On May 9, US District Judge Margaret Garnett issued an order amending the previous asset freeze, allowing Arbitrum’s security board to transfer approximately 30,765 ETH worth approximately $71 million to a wallet controlled by Aave LLC.
The ruling removed the final legal hurdle to implementing the recovery plan after a May 1 restriction notice linked to unrelated North Korean terrorism provisions blocked the transfer.
As mentioned by CryptopolitanAave’s DAO previously voted to liquidate the attacker’s frozen ETH funds, with 90% of voting addresses backed by 190 million ARB tokens agreeing.
Overall recovery efforts are now approximately 90% complete, said Thaddeus Benakiwicz, vice president of research at Galaxy Digital.
What will happen in the next two weeks?
Kelp said 117,132 rsETH will be “gradually refilled from Aave Recovery Guardian and Kelp Recovery Safe to the LayerZero OFT switch on the mainnet” over the next two weeks.
Kulikhov Written on X “The last step is to replenish the rsETH bridge security fund,” he said, adding that withdrawals to convert rsETH to ETH will begin within 24 hours to normalize the markets.
The total value of Aave locked has stabilized above $15 billion after initial outflows exceeding $10 billion in the days following the exploit. The utilization rate for WETH lending is 93%, USDT 92% and USDC 91%, indicating that the withdrawal pressure is over.
How the response differs from previous DeFi exploits
The rsETH recovery followed a different path than previous major hacks. The Ronin Bridge attack required massive external funding and recovered assets to compensate users for losses exceeding $600 million.
The Euler Finance exploit ended with the attacker returning most of the stolen funds after negotiations and public pressure.
Aave and Kelp took no path. Instead, the recovery focused on isolating bad collateral, liquidating the attacker’s on-chain positions, removing exploiter-controlled tokens from circulation during the May 12 burn, and rebuilding reserves within the bridge infrastructure through coalition-funded backfills.
It is also the first major recovery for a DeFi exploit to navigate through US federal court intervention and get user funds flowing again through government-coordinated channels.
