In a collaborative effort led by Aave, the DeFi United coalition has disclosed a technical blueprint aimed at restoring support for rsETH tokens and eliminating residual bad debt left in the wake of a North Korean hacking incident on platforms like Aave and Compound. This recovery scheme involves converting pledged ETH into rsETH in phased tranches and liquidating the attacker’s holdings through temporarily adjusted oracle prices. The initiative seeks to reclaim approximately 13,000 ETH from compromised positions on Aave’s Ethereum and Arbitrum networks, alongside 16,776 ETH from Compound.
https://t.co/9eUfrt0ESE
— Aave (@aave) April 28, 2026
The perpetrators had used 89,567 unbacked rsETH as collateral to borrow a total of 82,650 WETH and 821 wstETH across these platforms. The Arbitrum Security Council has already immobilized $71.5 million linked to the attackers’ wallets.
“Intentional interference by the hackers could lead to incomplete deficit accrual, necessitating additional liquidation steps for full resolution,” Aave cautioned.
As of Monday, the technical plan enjoys the support of significant industry entities, with a collective commitment of $303 million in capital and credit. Consensys and Joseph Lubin have pledged up to 30,000 ETH, while Aave Labs CEO Stani Kulechov has personally promised 5,000 ETH. Lido is considering allocating as much as 2,500 stETH (Disclosure: Consensys counts among the 22 investors in an editorially independent Decrypt).
“The Ethereum ecosystem thrives when we act collectively,” Lubin remarked, describing DeFi United’s effort as a “coordinated response to safeguard users and fortify the infrastructure we have all contributed to developing.”
This recovery drive addresses consequences stemming from the April 18 Kelp DAO breach, wherein North Korean hackers swindled $293 million by duping the protocol into issuing unbacked rsETH tokens. The attackers absconded with 116,500 rsETH—equivalent to 18% of its total circulating supply—leaving Aave and Compound vulnerable due to worthless collateral.
This marks one of DeFi’s most substantial coordinated recovery initiatives since the sector’s establishment, contrasting sharply with earlier protocol breaches where users typically bore losses individually.