Aave Liquidates Kelp DAO Attacker's rsETH Positions

AAVE0.48%
ZRO-0.33%
ETH0.89%
COMP-1.86%

Onchain lending platform Aave has liquidated the Kelp DAO attacker’s remaining rsETH positions as part of a previously announced recovery plan, according to an announcement on Wednesday. The liquidated collateral will be moved into the Recovery Guardian, a designated multisig managed by the DeFi United initiative, which is working to restore the rsETH backing and compensate affected users.

Background: The April 28 Exploit

On April 28, an attacker with suspected connections to North Korea manipulated Kelp DAO’s LayerZero-powered bridge to fraudulently mint 116,500 unbacked rsETH on Ethereum. These assets were then deployed in various onchain lending protocols, including Aave and Compound, to be exchanged for ETH. The exploit resulted in a $292 million loss.

Recovery Effort and Community Response

This liquidation represents one of the final steps in a community-wide effort to undo the damage. Contributions to DeFi United have exceeded $320 million, and the community has collaborated on ways to freeze addresses, recover stolen funds, and return to normalcy. The Arbitrum Security Council voted to freeze funds connected to the attack, with plans to return them to DeFi United.

Technical Process: Oracle Manipulation and Governance

Aave previously noted that its liquidations, which occurred on its Ethereum and Arbitrum deployments, required a governance process. In particular, Aave voted to temporarily manipulate the rsETH oracle price to generate a deficit in the attacker’s fraudulent position.

According to Aave’s announcement outlining the recovery plan: “All such adjustments will be fully reverted upon completion of the liquidation process, with no persistent configuration changes to the Aave protocol expected as a result of the governance proposal. Once the collateral is secured, the rsETH price oracle will be restored.”

Legal Complications

At present, the frozen funds are tied up in a separate lawsuit where plaintiffs are trying to claim them as restitution tied to terrorism-related judgments against North Korea.

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Comment
0/400
LiderVitriavip
· 05-07 01:34
Let's make history
View OriginalReply0
ShortTermKingvip
· 05-06 22:58
Steadfast HODL💎
View OriginalReply0
ShortTermKingvip
· 05-06 22:58
Steadfast HODL💎
View OriginalReply0
ShortTermKingvip
· 05-06 22:58
Steadfast HODL💎
View OriginalReply0
ByteBardvip
· 05-06 22:27
The resilience of DeFi is demonstrated at this moment, and Aave's recovery plan was executed quite decisively.
View OriginalReply0
GateUser-e5e2e632vip
· 05-06 21:11
rsETH position has been liquidated, the attacker is truly zeroed out now. Multi-signature custody is probably more reliable than direct destruction.
View OriginalReply0
GaslightSamuraivip
· 05-06 21:05
The Kelp DAO matter has finally wrapped up, with liquidation funds transferred to the multi-signature—A victory for community governance?
View OriginalReply0
AirdropEtiquettevip
· 05-06 21:05
Aave's liquidation this time was clean and efficient; the Recovery Guardian mechanism truly set an example for DeFi security.
View OriginalReply0