Aave liquidates the Kelp DAO attacker’s positions, and the Arbitrum vote approves unfreezing rsETH

According to an Aave announcement on May 7, the Arbitrum DAO vote regarding the ETH related to the April 18 rsETH incident that was aimed at unfreezing has reached quorum. Over 1,600 addresses voted in favor, receiving unanimous community support. On the same day, Aave, in accordance with established governance procedures, completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker on the Aave protocol.

Arbitrum DAO Vote Results and DeFi United Recovery Progress

According to an Aave statement dated May 7, 2026, the vote results were unanimous support from Arbitrum representatives and the community. More than 1.9 hundred million ARB tokens were used by over 1,600 addresses to complete the vote. The goal is to unfreeze ETH assets currently held by the Arbitrum DAO and related to the rsETH incident, to support DeFi United’s compensation work for affected users.

As reported by The Block, DeFi United has received more than $320 million in donations to date, exceeding the original amount of the vulnerability loss. Many participating parties have also helped with tasks such as freezing the related addresses and recovering the stolen funds.

Aave Liquidation Mechanism: rsETH Oracle Manipulation Process

According to Aave’s Wednesday announcement, this liquidation was carried out by temporarily adjusting the rsETH oracle price quotes. This was done to create an accounting loss within the attacker’s fraudulent position, thereby triggering the protocol’s liquidation mechanism. The collateral obtained from the liquidation was transferred to the Recovery Guardian multi-signature address, managed by DeFi United.

In a blog post from last week, Aave explained: “All such adjustments will be fully restored after the liquidation process is completed. The governance proposal is not expected to cause any permanent configuration changes to the Aave protocol. Once the collateral is secured, the rsETH price oracle will resume normal operation.”

Incident Timeline, Frozen Funds, and Legal Disputes

According to The Block, on April 28, 2026, a suspected attacker with links to North Korea manipulated the Kelp DAO cross-chain bridge based on LayerZero technology, illegally minted 116,500 unsecured rsETH on Ethereum, and deployed the related assets to lending protocols on chains such as Aave and Compound in order to exchange for ETH, resulting in an approximately $292 million loss.

Previously, the Arbitrum Security Committee voted to freeze funds related to the attack and planned to transfer them to DeFi United. As reported by The Block, the frozen funds are currently involved in another legal lawsuit, in which the plaintiff attempted to claim the related assets as compensation for judgments related to North Korean terrorism.

FAQ

What is the purpose of this Arbitrum DAO vote?

According to Aave’s May 7, 2026 statement, the purpose of this vote is to authorize the unfreezing of ETH assets related to the April 18 rsETH incident that are held by the Arbitrum DAO, to support DeFi United’s compensation work for affected users.

How did Aave complete the liquidation of the Kelp DAO attacker’s position?

According to Aave’s announcement, Aave temporarily manipulated the rsETH oracle price quotes under the governance process, creating an accounting loss in the attacker’s fraudulent position to trigger liquidation. The collateral obtained from liquidation was transferred to the Recovery Guardian multi-signature address, managed by DeFi United.

What legal obstacles do the frozen funds currently face?

According to The Block, the attack-related funds frozen by the Arbitrum Security Committee are currently involved in a legal lawsuit. The plaintiff is attempting to assert a claim over the above funds on the basis of judgments related to North Korean terrorism, and the relevant legal proceedings are still ongoing.