The leading lending protocol Aave has liquidated the remaining positions of hacker Kelp involving rsETH as part of an approved recovery plan.

In line with the technical plan outlined below, the attacker's rsETH positions on Aave have been liquidated on Ethereum and Arbitrum. The liquidated collateral now sits with the Recovery Guardian as specified in the AIP.

No other users were affected, and Umbrella was also… https://t.co/GQxroGuME0

— Aave (@aave) May 6, 2026

The funds obtained are being transferred to a special multi-signature wallet managed by the DeFi United fund. These assets will be used to restore the rsETH collateral and compensate affected users.

How the Liquidation Occurred

The hacker's positions were held in Aave's versions on Ethereum and Arbitrum. The liquidation required community approval, with over 90% of users supporting the decision.

Thanks to the 1,600+ addresses representing over 190 million ARB tokens who have voted on unfreezing the ETH related to the April 18 rsETH incident, currently held by the Arbitrum DAO.

Reaching quorum with a strong show of approval from delegates and the Arbitrum community is a… pic.twitter.com/mhIHH7iZ89

— Aave (@aave) May 6, 2026

The DAO temporarily adjusted the oracle price of rsETH to create a deficit in the hacker's position, and after the liquidation, the parameters were reverted to their original values.

Fighting for 30,000 ETH

At the time of publication, the DeFi United initiative has raised over $320 million from industry participants and users. The largest contribution came from the L2 network Arbitrum, which froze 30,766 ETH following the attack.

In early May, the project's DAO initiated a vote to transfer these funds to the recovery fund, a move supported by 90.5% of the community.

Source: snapshot.org.

The final decision was expected on May 7, but a New York court prohibited Arbitrum from accessing the frozen coins, which are claimed by victims of North Korean terrorists from the 2015 thefts.

Aave called the court's reasoning legally unsound and demanded the lifting of restrictions. The plaintiffs' lawyers questioned the project's right to contest the freeze.

Recall that on May 6, hackers attacked the market maker TrustedVolumes, stealing $6 million. This marked the fifth hack of the month.