DeFi United Announces rsETH Recovery Plan After $292M Exploit

DeFi United, a coalition of decentralized finance protocols and participants, announced a detailed recovery plan on April 28, 2026, to restore full backing for Kelp DAO's rsETH token following a $292 million exploit on its bridge on April 18.

The attack exploited a vulnerability in the LayerZero bridge between Unichain and Ethereum. Attackers sent a forged inbound message that triggered the minting of 116,500 unbacked rsETH tokens from the Ethereum-side adapter without a corresponding asset burn on the source chain. Roughly 107,000 of those tokens were deposited as collateral in eight positions across Aave's Ethereum Core and Arbitrum markets, as well as on Compound, leaving lending protocols exposed to bad debt estimated between $196 million and $230 million depending on loss scenarios.

In response, Aave's Protocol Guardian froze rsETH and related reserves across deployments within hours, set loan-to-value ratios to zero, and adjusted interest rate models to manage liquidity. Protocols including Compound and Euler also suspended or restricted rsETH activity to contain cascading risks. DeFi United formed shortly after on April 23 to coordinate recovery, securing over $300...