DeFi United has outlined a recovery plan for rsETH after Kelp DAO was hit by an attack attributed to North Korea's Lazarus Group, with losses totaling $292 million, CoinDesk reported. In a separate prediction market tracking whether another crypto hack of more than $100 million will occur by Dec. 31, the contract is priced at 100.0% "Yes". The market notes 251 days remain until settlement. The Kelp DAO exploit is being described as the largest DeFi vulnerability incident of 2026, aligning with North Korea's history of cyber operations used to raise funds amid international sanctions. The incident prompted heavy outflows from Aave and tightened liquidity across related lending protocols. With odds pinned at the ceiling, trading activity has dropped to zero. Traders are treating the outcome as effectively certain, leaving little room for price discovery. The biggest prior move in this market was on April 30, when pricing rose by 5 points. At 100 cents, a "YES" share is valued at $1, making the trade about certainty rather than speculation. Any future repricing would hinge on fresh developments and on the execution of DeFi United's recovery work with partners. Focus areas include the Arbitration Security Committee's decision on freezing the attacker's assets and KelpDAO's progress on restoring redemptions, both of which could affect public-market sentiment and the timing of redemptions tied to DeFi security in the coming months. ## API Access

Stablecoin transfer volumes have exceeded $1 trillion so far this month, according to DefiLlama.

Ondo Finance is adding a proxy-voting option to its tokenized equities, aiming to bring onchain stock products closer to traditional market norms by giving investors a channel to participate in corporate governance. Developed in partnership with Broadridge Financial Solutions (BR), the feature covers more than 250 tokenized securities on Ondo's platform. Through Broadridge's ProxyVote system, token holders can review corporate filings and submit voting instructions. Access is handled via crypto wallets, after which investors can use governance tools typically available through brokerage accounts. Tokenized equities have become one of crypto's fastest-growing segments, putting stocks and ETFs on blockchain rails. The category now accounts for more than $1.1 billion in total value locked, triple the level a year ago, according to RWA.xyz. Ondo is the sector's largest issuer, reporting more than $700 million in tokenized stocks and ETFs on its Global Markets platform, which is offered to non-U.S. investors. Proxy voting is a notable addition because many tokenized equity products have historically offered limited governance participation. Ondo said its tokens remain separate from the underlying shares and do not confer direct shareholder rights. Instead, the system allows investors to express preferences that Ondo can apply when casting votes for the shares it holds. "It really hits at the heart of Ondo's vision to make traditional financial assets more accessible," Matthieu de Vergnes, Ondo's global head of institutional, told CoinDesk. "You get all the benefits of being onchain – freely transferable, compatible with DeFi – and on top of that, you get the governance that you have from the the underlying." Broadridge, a major processor of proxy votes in traditional markets, said it is extending its infrastructure to blockchain-based systems with the goal of supporting digital and conventional assets within the same workflows. Danielle Gurrieri, senior vice president and head of product management at Broadridge, said providing investors with comparable auditability, transparency, and compliance will help scale tokenized markets and build trust among end investors.

Author | Azuma (@azuma_eth) Aave's rsETH-related bad debt episode, which has dragged on for more than a week, is moving toward resolution. DeFi United says it has now raised enough capital to support the fix; as of publication, commitments total 132,704 ETH, worth about $302 million. Aave published its technical implementation plan on April 28 at noon, aiming to repair rsETH collateral conditions and bring markets back to normal. Odaily note: Prior coverage includes "DeFi Again Stolen $292 Million—Is Aave No Longer Safe?", "The ThreeWay博弈 Under a $290 Million Hole: Who Will Pay Up—Aave, L0, or Kelp?", and "Aave Is Handing Over the Throne of DeFi Lending Due to Its Own Foolishness". Background The key issue is no longer the mechanics of Kelp DAO's 116,500 rsETH loss, but what happened after the attacker took control. The hacker split 116,500 rsETH across multiple addresses. Part was deposited as collateral on Aave V3 on Ethereum mainnet to borrow WETH; another portion was bridged to Arbitrum and used as collateral on Aave there to borrow WETH. A smaller remainder moved through other routes. Seven hacker-linked addresses still maintain active rsETH collateral positions on Aave and Compound, holding roughly 107,000 rsETH of the original 116,500. Plan and objectives Aave's plan targets two outcomes: (1) restore rsETH's collateral backing; (2) unwind affected lending-market positions on Aave and Compound to recover about 107,000 rsETH in overcollateralized assets and repair market damage. 1) Restoring rsETH collateral backing Aave describes rsETH as currently insolvent: while the underlying staked ETH remains intact, the attacker extracted value via collateralized borrowing, creating a shortfall that pushed rsETH off its peg. To restore backing, Aave says the rsETH/ETH exchange rate needs to return to 1:1.07. DeFi United is expected to drive this step using pledged ETH, subject to governance approval, execution timing, and the signing of relevant agreements. If approved, DeFi United will replenish backing by depositing ETH into the rsETH bridge lockup contract (RSETH_OFTAdapter 0x85d456b2…98ef3). The proposed sequence: - Convert DeFi United's ETH into rsETH in batches - Transfer rsETH into the relevant staking contract - Re-enable the bridge system so it can safely resume full operations LayerZero and Kelp DAO plan to add further security measures to harden the bridge after restoration. 2) Clearing abnormal lending positions Once rsETH backing is restored, Aave expects bad debt to be eliminated in principle because collateral value should again exceed borrowed value. Even so, abnormal hacker-linked positions still need to be cleared to normalize operations, with an estimated recovery of 13,000 ETH. Aave plans to submit sequential governance proposals on Ethereum and Arbitrum to run a "controlled liquidation process." Steps outlined: - Temporarily adjust the rsETH oracle price to enable efficient liquidations - Accept a temporary shortfall during settlement, to be covered in later steps - Transfer redeemed rsETH collateral to a DeFi United-managed multisig Aave says these parameter changes are strictly temporary and will be rolled back after completion, with no long-term effect on the protocol. During the process, deposits of WETH and rsETH will remain frozen across Ethereum mainnet, Arbitrum, Base, Mantle, and Linea. Target end state: restore the rsETH price oracle; redeem recovered rsETH for ETH through Kelp DAO's standard redemption path; use the resulting ETH to cover deficits in Aave's Ethereum and Arbitrum markets. For Compound, Aave expects a similar cleanup approach. With liquidity support from DeFi United, the effort is projected to recover an additional ~16,776 ETH. Open questions and risks Aave says the proposal is designed to resolve the situation without socialized losses, but flags several uncertainties: - Even with sufficient ETH commitments, deployment hinges on final agreements and governance approval - Position cleanup depends on governance proposals passing and being executed smoothly - If the attacker actively interferes, losses may not be fully realized, potentially requiring additional liquidation actions - LayerZero and Kelp have rolled out added safeguards, but residual risk remains until validated in production The "Kelp DAO hack and Aave bad debt" episode appears close to conclusion, though the real test will be execution. As Andy, founder of The Rollup, put it: "The next few days are crucial for DeFi—tasks are daunting and must be completed both quickly and securely. This is not only a technical challenge but also a test of social coordination. It truly feels surreal to witness these developments in real time." For now, the market is watching whether the proposed fix plays out as intended.

The rsETH-linked bad-debt situation on Aave, which has dragged on for more than a week, is moving toward resolution. DeFi United has already lined up enough capital to support the fix—132,704 ETH pledged as of publication, worth about $302 million. Aave said it released a technical implementation plan around midday on April 28 aimed at repairing rsETH collateral conditions and bringing markets back to normal. What happened The market focus has shifted from the initial loss at Kelp DAO—116,500 rsETH—to where the assets went next. After gaining control of the funds, the attacker split the 116,500 rsETH across multiple addresses. Portions were supplied as collateral to Aave V3 on Ethereum to borrow WETH, while other tranches were bridged to Arbitrum and used similarly on Aave there. Additional amounts moved through other routes. Aave said seven attacker-linked addresses still maintain active rsETH collateral positions across Aave and Compound, holding roughly 107,000 rsETH of the original 116,500. Aave's two-part repair plan Aave's proposal targets two outcomes: (1) restore rsETH's collateral backing, and (2) unwind attacker-related lending positions across Aave and Compound to recover roughly 107,000 rsETH worth of overcollateralized assets and repair market damage. 1) Restoring rsETH backing Aave described rsETH as currently insolvent. While the underlying staked ETH remains intact, the attacker extracted value through collateralized borrowing, creating a shortfall and pushing rsETH off its peg. To re-establish backing, Aave said the rsETH/ETH exchange rate needs to be brought back to 1:1.07. DeFi United, having secured sufficient pledged ETH, would drive the restoration, subject to governance approvals, execution timing, and the signing of related agreements. If approved, DeFi United would deposit ETH into rsETH's bridge lockup contract (RSETH_OFTAdapter 0x85d456b2…98ef3) to fully restore backing. Aave outlined the flow as: - convert DeFi United's ETH into rsETH in batches; - transfer rsETH into the relevant staking contract; - re-enable the bridge to safely recover and resume full operations. LayerZero and Kelp DAO are expected to add security measures to harden the bridge once restored. 2) Clearing abnormal lending positions After rsETH backing is restored, Aave said the protocol should no longer face bad debt in theory because collateral value would exceed borrowed value. Even so, attacker-linked collateral positions would remain abnormal and need to be cleared to normalize operations, with Aave estimating about 13,000 ETH could be recovered. Aave said it will submit governance proposals on Ethereum and Arbitrum to execute a "controlled liquidation process." Key steps include: - temporarily adjusting the rsETH oracle price to enable efficient liquidations; - accepting a temporary shortfall during settlement, to be covered later in the process; - transferring recovered rsETH collateral to a DeFi United-managed multisig. Aave emphasized these parameter changes are temporary, intended only to restore functionality, and will be rolled back afterward with no long-term impact on the protocol. During the process, deposits of WETH and rsETH will remain frozen on Ethereum mainnet, Arbitrum, Base, Mantle, and Linea. End state and Compound cleanup Aave's targeted outcome is to restore the rsETH price oracle, redeem recovered rsETH into ETH via Kelp DAO's standard redemption process, and use that ETH to cover deficits in Aave's Ethereum and Arbitrum markets. For Compound, Aave expects a similar cleanup approach. With liquidity support from DeFi United, about 16,776 ETH is projected to be recovered. Once both objectives are completed, Aave plans to lift the suspensions and deposit freezes across affected markets, then restore loanto-value (LTV) settings and other parameters for ETH and related assets. Open questions Aave flagged remaining uncertainties: pledged ETH is in place but still depends on final agreements and governance approval; the cleanup hinges on governance proposals passing and being executed smoothly; an attacker could interfere and force additional liquidation steps; and while LayerZero and Kelp have deployed extra protections, residual risk remains until the changes are validated in production. Still, the extended "Kelp DAO hack and Aave bad debt" episode now appears close to an operational conclusion—pending whether the plan works as intended in practice. As Andy, founder of The Rollup, put it: "The next few days are crucial for DeFi—tasks are daunting and must be completed both quickly and securely. This is not only a technical challenge but also a test of social collaboration. It truly feels surreal to witness these developments in real time."

DeFi United has announced a plan to restore rsETH in the wake of the Kelp DAO exploit, which resulted in an estimated $292 million loss.

Chainlink recorded its largest daily net outflow from exchanges so far in 2026, with about 970,430 $LINK leaving known trading venues in a single day, according to on-chain analytics platform Santiment. The withdrawals total roughly $8.95 million in LINK moved off exchanges at once. Santiment said it was Chainlink's biggest daily net outflow since Dec. 2, 2025. Large exchange outflows are often interpreted as investors shifting holdings into cold storage.

Huoju Finance, citing Hyperinsight monitoring, said whale address 0x535 holds the most vulnerable multimillion-dollar position on Hyperliquid. The address's top three long positions are roughly $50 from liquidation. The whale currently has about $22.8 million in ETH long exposure, with a liquidation price of $2,237 and an unrealized loss of around $390,000 (43.7%). It also maintains long positions in BTC, HYPE and other assets. If prices keep falling, liquidation thresholds across its positions are expected to move higher. For comparison, the platform's second-largest ETH long holder, Huang Licheng ("Maji"), has a $35.68 million ETH long position with a liquidation price of $2,215, plus about $42.7 million in BTC longs, and is also exposed to rising liquidation levels. Addresses: 0x535e34b5ada64997afc88444271ae9b3f82b3867, 0x020ca66c30bec2c4fe3861a94e4db4a498a35872.

ChainCatcher reports that Hyperinsight data shows whale address 0x535 holds one of Hyperliquid's three largest ETH long positions and is now just $50 from liquidation, the tightest margin among the platform's multimillion-dollar whales. The wallet has about $22.8 million in ETH longs with a liquidation price of $2,237 and an unrealized loss of roughly $390,000 (43.7%). The address also maintains long exposure in other assets including BTC and HYPE. If prices continue to fall, liquidation thresholds across its positions would move higher. By comparison, the second-largest ETH long is held by "Maji" Huang Licheng, with a $35.68 million position and a liquidation price of $2,215. He also holds about $42.7 million in BTC longs, with liquidation risk increasing as thresholds are adjusted upward. Addresses: 0x535e34b5ada64997afc88444271ae9b3f82b3867, 0x020ca66c30bec2c4fe3861a94e4db4a498a35872.