Aave, Compound Back DeFi United Plan to Clean Up $290M Kelp DAO Exploit Fallout

CoinDesk reported that DeFi United, an alliance led by Avi, has published a technical proposal designed to restore backing for rsETH and remove the bad debt left on Aave and Compound following a North Korea-linked exploit. The plan calls for batching pledged ETH into rsETH, then liquidating the attacker's positions by temporarily adjusting oracle prices. DeFi United estimates it can recover about 13,000 ETH tied to Aave positions across Ethereum and Arbitrum, and another 16,776 ETH from Compound. According to the report, the attackers had deposited 89,567 unbacked rsETH as collateral and borrowed 82,650 WETH and 821 wstETH across multiple venues. The Arbitration Security Committee has frozen $71.5 million traced to the attacker's address. Aave cautioned that "the attacker's intentional interference may result in incomplete loss accumulation, requiring additional liquidation steps to fully resolve the position." Industry participants have backed the proposal, committing a combined $303 million in capital and credit as of Monday. Consensys and Joseph Lubin pledged up to 30,000 ETH, Aave Labs CEO Stani Kulechov committed 5,000 ETH personally, and Lido proposed allocating up to 2,500 stETH. (Disclosure: Consensys is one of the 22 investors in Decrypt, which maintains editorial independence.) Lubin said "the Ethereum ecosystem is always at its best when it evolves in sync," describing DeFi United as "a broad, coordinated response aimed at protecting users and strengthening the infrastructure we've collectively helped build." The initiative follows the April 18 hack of Kelp DAO, where North Korean attackers used protocol deception to mint unbacked rsETH and steal $293 million. The theft included 116,500 rsETH—about 18% of circulating supply—raising the risk that Aave and Compound could be left holding worthless collateral. The effort is shaping up as one of the largest coordinated recovery attempts since DeFi's emergence, in contrast to earlier incidents where users often absorbed losses directly.