DeFi United Unveils Recovery Plan to Make Kelp DAO's rsETH Whole After $292M Hack

DeFi United, a coalition of DeFi ecosystem participants, has published a technical proposal to restore full backing for Kelp DAO's rsETH following a $292 million exploit, CoinDesk reported. The April 18 incident is widely attributed to North Korea's Lazarus Group. Attackers reportedly used a forged message to compromise Kelp DAO's rsETH bridge and mint 116,500 unbacked rsETH. Roughly 107,000 of those tokens later reached Aave's lending markets, creating significant bad debt. Aave and dozens of DeFi protocols have contributed to DeFi United to contain the broader industry impact. The initiative has raised more than $300 million in ETH on Ethereum. With sufficient ETH commitments secured, Aave said DeFi United is prepared to begin the recovery. DeFi United said the process will convert committed ETH into rsETH in batches and transfer the rsETH to affected lockbox contracts, allowing the bridge to safely return to full operation. The plan also requires approvals from relevant regulatory authorities, an implementation timetable, and execution of a final agreement. Alongside restoring rsETH backing, the proposal calls for liquidating eight affected positions on Aave's Ethereum Core and Arbitrum markets to help recover about 13,000 ETH. The liquidation is designed as a controlled sequence, temporarily adjusting the rsETH oracle price to efficiently unwind the positions. Liquidated rsETH collateral would be sent to a DeFi United-controlled multisignature wallet, swapped for ETH via KelpDAO, and used to cover any temporary losses incurred on Aave. Compound, also impacted by the exploit, is expected to take similar steps to remove the attacker's footprint, recovering an estimated 16,776 ETH. The final stage would unpause and unfreeze rsETH and ETH across affected deployments and restore loan-to-value (LTV) ratios for ETH and any other assets whose parameters were temporarily modified. DeFi United said the plan is designed to restore rsETH without imposing socialized losses, while acknowledging risks. A central challenge is that deployment depends on final agreements and government approvals, leaving a window in which attackers could attempt to interfere. The group warned that deliberate interference could prevent losses from being fully crystallized, potentially requiring additional liquidation actions to fully resolve the positions. The statement also noted that new security measures introduced by LayerZero and Kelp DAO after the exploit remain in "production" and have not yet been tested under real-world conditions. As a result, ETH-to-rsETH conversions and lockbox deposits will be executed in batches. DeFi United said it will provide public updates as the recovery progresses.