DeFi United’s Restoration of rsETH Backing: Technical Implementation Plan

DeFi United, a coalition of ecosystem participants, has issued the technical implementation plan to restore the @KelpDAO rsETH backing following the April 18 incident, covering the full path to making rsETH whole and resuming normal market operations.

Background of the Incident

On April 18, 2026, an exploit targeted rsETH's bridge on the Unichain to Ethereum rsETH route. A forged inbound packet was verified on the Ethereum side without a corresponding burn on Unichain, causing 116,500 rsETH to be released from the Ethereum-side adapter.

The 116,500 released rsETH was subsequently distributed across multiple addresses. A portion was supplied as collateral on Aave V3 on Ethereum, while another portion was bridged to Arbitrum and used to open positions on Aave Arbitrum. Remaining portions were routed through different venues.

Currently, seven addresses associated with the exploiter hold active rsETH-backed positions on Aave and Compound, representing approximately 107,000 rsETH of the original 116,500 rsETH stolen. The recovery effort focuses on two objectives: (1) restoring the backing of rsETH, and (2) clearing up the affected positions in liquidity markets to recover approximately 107,000 rsETH in excess collateral and resolve the resulting market impairment.

Restoring rsETH Backing

To restore rsETH backing, it must reflect its nominal Kelp rsETH exchange ratio, currently at 1.07 ETH. This is being achieved through the DeFi United initiative, which has secured the ETH commitments necessary to restore full operability of the affected systems, with final execution subject to completion of relevant governance approvals, execution timelines, and execution of definitive agreements. Subject to the successful execution of the plan, rsETH's backing will be fully restored by depositing ETH into the bridge lockbox (RSETH_OFTAdapter 0x85d456b2…98ef3).

The restoration process involves converting the committed ETH into rsETH in tranches, which will then be transferred to the affected lockbox contract, allowing the bridge to securely resume full operation. Both @LayerZero_Core and Kelp have implemented additional measures to ensure the bridge's security upon resumption of normal operations.

Clearing Up Affected Positions and Recovering Collateral

In parallel with restoring the rsETH backing, the recovery plan includes clearing up the eight affected positions across the Aave Ethereum Core and Arbitrum markets. Clearing up these positions is a necessary step to recovering approximately 13,000 ETH worth of funds on Aave and resolving the resulting impairment on the affected markets.

This process is required to be executed through specific governance proposals targeting both the Ethereum and Arbitrum deployments. The technical execution involves a controlled liquidation sequence: the rsETH oracle price will be temporarily adjusted to enable efficient liquidation of the positions, generating a temporary deficit that will be addressed in a subsequent step. The recovered rsETH collateral will be transferred to a designated multisig managed by DeFi United. The configuration adjustments made in connection with this process described above are temporary and scoped solely for the execution of the recovery. All such adjustments will be fully reverted upon completion of the liquidation process, with no persistent configuration changes to the Aave protocol expected as a result of the governance proposal.

Once the collateral is secured, the rsETH price oracle will be restored. The recovered rsETH will then be redeemed for ETH through Kelp's standard redemption procedure. The resulting ETH will be applied to clear the deficit in both the Aave Ethereum and Arbitrum markets.

Compound will take a similar approach to clearing the exploiter's position, with DeFi United providing the liquidity needed. This initiative, led by their team, would recover approximately 16,776 ETH worth of funds after completion.

WETH and rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle, and Linea will remain frozen during this period.

Restoring Normal Market Operations

The restoration of rsETH backing and the clearing up of affected positions can be executed in parallel.

This final phase of the restoration process involves unpausing and unfreezing rsETH and ETH across all affected instances, and restoring the Loan-to-Value (LTV) ratios for ETH and any other assets whose configurations were temporarily adjusted.

Considerations

While the plan is designed to restore rsETH backing without socializing losses, execution is subject to the following risks.

DeFi United has secured sufficient ETH commitments to restore full backing, but deployment remains subject to finalizing agreements and governance approvals.

Closing the affected positions requires governance proposals to pass and execute correctly on both Ethereum and Arbitrum. Deliberate interference by the attacker could result in incomplete deficit accrual, requiring additional liquidation steps to fully resolve the positions.

LayerZero and Kelp have implemented additional security measures ahead of resuming bridge operations, though residual risk remains until those measures are validated in production. In line with this approach to risk management, ETH-to-rsETH conversion and lockbox deposits will occur in several tranches.

The successful coordinated execution of these steps as planned ensures that rsETH backing is fully restored, and all affected markets are stabilized. Progress will be communicated publicly as recovery efforts advance.