Aave Unveils Technical Plan to Resolve rsETH Bad-Debt Fallout

The rsETH-linked bad-debt situation on Aave, which has dragged on for more than a week, is moving toward resolution. DeFi United has already lined up enough capital to support the fix—132,704 ETH pledged as of publication, worth about $302 million. Aave said it released a technical implementation plan around midday on April 28 aimed at repairing rsETH collateral conditions and bringing markets back to normal. What happened The market focus has shifted from the initial loss at Kelp DAO—116,500 rsETH—to where the assets went next. After gaining control of the funds, the attacker split the 116,500 rsETH across multiple addresses. Portions were supplied as collateral to Aave V3 on Ethereum to borrow WETH, while other tranches were bridged to Arbitrum and used similarly on Aave there. Additional amounts moved through other routes. Aave said seven attacker-linked addresses still maintain active rsETH collateral positions across Aave and Compound, holding roughly 107,000 rsETH of the original 116,500. Aave's two-part repair plan Aave's proposal targets two outcomes: (1) restore rsETH's collateral backing, and (2) unwind attacker-related lending positions across Aave and Compound to recover roughly 107,000 rsETH worth of overcollateralized assets and repair market damage. 1) Restoring rsETH backing Aave described rsETH as currently insolvent. While the underlying staked ETH remains intact, the attacker extracted value through collateralized borrowing, creating a shortfall and pushing rsETH off its peg. To re-establish backing, Aave said the rsETH/ETH exchange rate needs to be brought back to 1:1.07. DeFi United, having secured sufficient pledged ETH, would drive the restoration, subject to governance approvals, execution timing, and the signing of related agreements. If approved, DeFi United would deposit ETH into rsETH's bridge lockup contract (RSETH_OFTAdapter 0x85d456b2…98ef3) to fully restore backing. Aave outlined the flow as: - convert DeFi United's ETH into rsETH in batches; - transfer rsETH into the relevant staking contract; - re-enable the bridge to safely recover and resume full operations. LayerZero and Kelp DAO are expected to add security measures to harden the bridge once restored. 2) Clearing abnormal lending positions After rsETH backing is restored, Aave said the protocol should no longer face bad debt in theory because collateral value would exceed borrowed value. Even so, attacker-linked collateral positions would remain abnormal and need to be cleared to normalize operations, with Aave estimating about 13,000 ETH could be recovered. Aave said it will submit governance proposals on Ethereum and Arbitrum to execute a "controlled liquidation process." Key steps include: - temporarily adjusting the rsETH oracle price to enable efficient liquidations; - accepting a temporary shortfall during settlement, to be covered later in the process; - transferring recovered rsETH collateral to a DeFi United-managed multisig. Aave emphasized these parameter changes are temporary, intended only to restore functionality, and will be rolled back afterward with no long-term impact on the protocol. During the process, deposits of WETH and rsETH will remain frozen on Ethereum mainnet, Arbitrum, Base, Mantle, and Linea. End state and Compound cleanup Aave's targeted outcome is to restore the rsETH price oracle, redeem recovered rsETH into ETH via Kelp DAO's standard redemption process, and use that ETH to cover deficits in Aave's Ethereum and Arbitrum markets. For Compound, Aave expects a similar cleanup approach. With liquidity support from DeFi United, about 16,776 ETH is projected to be recovered. Once both objectives are completed, Aave plans to lift the suspensions and deposit freezes across affected markets, then restore loanto-value (LTV) settings and other parameters for ETH and related assets. Open questions Aave flagged remaining uncertainties: pledged ETH is in place but still depends on final agreements and governance approval; the cleanup hinges on governance proposals passing and being executed smoothly; an attacker could interfere and force additional liquidation steps; and while LayerZero and Kelp have deployed extra protections, residual risk remains until the changes are validated in production. Still, the extended "Kelp DAO hack and Aave bad debt" episode now appears close to an operational conclusion—pending whether the plan works as intended in practice. As Andy, founder of The Rollup, put it: "The next few days are crucial for DeFi—tasks are daunting and must be completed both quickly and securely. This is not only a technical challenge but also a test of social collaboration. It truly feels surreal to witness these developments in real time."