The Aave lending protocol has detailed a coordinated recovery plan following a significant exploit on April 18. The incident involved 116,500 rsETH tokens, a large portion of which were used as collateral on Aave and other platforms. The plan, led by the DeFi United group, involves liquidating affected positions, converting the recovered assets to ETH, and using the funds to cover the shortfall and restore the token’s backing.
Aave has announced a recovery plan after an April 18 exploit affected its liquidity markets on several chains. The plan, involving participants from DeFi United, aims to restore the backing of the rsETH token and bring affected markets back to normal.
The exploit began when an attacker targeted a vulnerability in rsETH’s bridge from Unichain to Ethereum. This resulted in the fraudulent release of 116,500 rsETH, which was then used as collateral on Aave 3 and bridged to Arbitrum.
Early mitigation efforts saw the Arbitrum security council freeze 30,766 ETH linked to the exploit. Roughly 107,000 rsETH from the stolen amount remains locked in active positions on Aave and Compound today.
Aave said the plan is to convert ETH into rsETH in stages and deposit it into the bridge lockbox to resume operations. Concurrently, LayerZero and KelpDAO have implemented additional security measures.
The protocol will work on clearing affected positions through governance proposals on Ethereum and Arbitrum. A temporary price adjustment for rsETH will also be made to facilitate easier liquidations.
Recovered tokens will be sent to a DeFi United multisig wallet, redeemed for ETH, and used to cover the shortfall across affected markets. The firm estimates these efforts will help recover approximately 13,000 ETH on Aave.
Compound is expected to regain roughly 16,776 ETH as part of the process. All WETH and rsETH reserves on several major chains will remain frozen throughout the recovery period.
Aave noted the procedure aims to restore rsETH without spreading losses to users but carries execution risks. These risks include securing required governance approvals and potential interference from the attacker during recovery.
The project’s team asserted that following this plan will fully restore the rsETH and settle the markets. “The successful coordinated execution of these steps as planned ensures that rsETH backing is fully restored, and all affected markets are stabilized,” they stated.
