Aave has liquidated the remaining rsETH holdings of the Kelp DAO attacker, as the DeFi community pushes forward with a $292 million attack aftermath.

On May 7, Aave announced it has completed the liquidation of the remaining rsETH position held by the Kelp DAO attacker. The associated collateral will be transferred to DeFi United’s Recovery Guardian multisig wallet to replenish the rsETH reserve and compensate affected users. This liquidation is a key step in the $292 million Kelp DAO attack recovery plan. Earlier, the Aave community approved a governance proposal to temporarily adjust the rsETH oracle price, making the attacker’s position undercollateralized and triggering liquidation. Aave noted all related parameters will be fully restored post-liquidation, with no long-term impact on the protocol. The incident began on April 28, when an attacker reportedly tied to North Korea exploited a cross-chain bridge vulnerability in LayerZero-based Kelp DAO to fraudulently mint roughly 116,500 unbacked rsETH on Ethereum. The attacker then cashed out ETH via lending protocols including Aave and Compound. Following the attack, the DeFi community took coordinated action—freezing relevant addresses, recovering funds, and arranging compensation. To date, DeFi United has secured over $320 million in support. The Arbitrum Security Council previously voted to freeze some involved funds, though these assets are now tangled in litigation tied to North Korea-related compensation.