Aave liquidates attacker positions in rsETH exploit recovery effort

Aave has liquidated the attacker’s rsETH positions on both Ethereum and Arbitrum.  This marks a key step in its ongoing recovery process following the April exploit.

The protocol confirmed that the collateral from the liquidations has been transferred to a designated Recovery Guardian, as outlined in its governance plan.

Liquidation secures collateral for recovery

The liquidations were carried out in line with the technical roadmap previously approved through an Aave Improvement Proposal [AIP].

    AD

By closing out the attacker’s positions, Aave has effectively converted compromised collateral into recoverable assets. The move reduces the protocol’s exposure to bad debt created during the exploit.

The seized assets are now held under the Recovery Guardian. This is a mechanism designed to manage and distribute funds as part of the broader compensation process.

Aave added that no other users were impacted during the liquidation process, and its core safety system, known as Umbrella, remained unaffected.

Part of a broader recovery effort

The update follows the April 18 exploit involving Kelp DAO’s rsETH, where attackers used unbacked assets to borrow funds across DeFi protocols, including Aave.

The incident led to significant losses and triggered coordinated action across the ecosystem. This included asset freezes and governance-led recovery initiatives.

Aave’s latest move represents a controlled step toward stabilizing the protocol’s balance sheet and reclaiming value from the exploit.

Next steps remain in focus

While the liquidation secures a portion of the affected assets, the broader recovery process is still ongoing.

Aave noted that additional steps are expected as part of the recovery roadmap, though details have yet to be fully outlined.

The situation remains complicated by earlier legal actions tied to frozen funds. This has introduced uncertainty around how and when assets can be redistributed.

Final Summary

• Aave has liquidated the attacker’s rsETH positions on Ethereum and Arbitrum, securing collateral under its Recovery Guardian as part of its recovery plan.
• The move reduces bad debt exposure and marks progress in the protocol’s efforts to recover funds following the April exploit.