Aave rsETH Recovery Phase II: Hacker Liquidated, What Is Next?

The $71M Legal Freeze Blocking Full Aave rsETH Recovery

What do you do when a $293 million hack gets a legal freeze slapped on the recovered funds?

That's the exact situation facing Aave right now. The Aave rsETH recovery crossed a major milestone on May 6. The attacker's eight positions on Aave V3 were liquidated on Ethereum and Arbitrum. But a U.S. court restraining notice then froze $71 million in recovered ETH — and that legal battle has become the story behind the story.

Source: X(formerly Twitter)

How Aave Executed the rsETH Attacker Liquidation

On April 18, 2026, an attacker exploited Kelp DAO's LayerZero bridge — a cross-chain messaging system — and fraudulently minted 116,500 rsETH tokens without backing them with real assets. The attacker deposited roughly 89,500 tokens into Aave's V3 as collateral and borrowed wrapped ETH against them. That single move created over $190 million in bad debt.

Aave's TVL — total value of funds deposited — dropped $12 billion in one week.

The Aave rsETH recovery team, under the DeFi United coalition, moved fast. DAO voted to temporarily adjust the price oracle — the system that values inside the protocol — to create a deficit in the attacker's positions. That made forced liquidation technically possible.

On May 6, all eight attacker positions were liquidated. Recovered collateral moved to the Recovery Guardian, a secure multi-signature wallet managed by DeFi United. Three key facts:

• No regular users were affected by the liquidation

• The Umbrella insurance fund — Aave's automated bad-debt protection — was not activated

• Aave's TVL has rebounded above $15 billion after falling to $14.2 billion

According to Thaddeus Pinakiewicz, vice president of research at Galaxy Digital, the Aave rsETH recovery is now only 10% short of the ETH needed to fully restore rsETH's backing.

The $71M Legal Freeze Blocking Full Aave rsETH Recovery

Here's where things get complicated.

Arbitrum DAO voted to return 30,765 ETH — roughly $71 million — to the recovery effort. More than 90% of voters approved. But on May 1, a U.S. law firm filed a restraining notice on behalf of plaintiffs holding judgments against North Korea. The firm claimed the ETH might be linked to North Korea's Lazarus Group — the state-sponsored hacking team behind major crypto thefts.

That notice froze the $71 million before it reached users.

LLC filed an emergency motion to vacate the notice. A hearing took place on May 6. The judge accepted LLC's proposal — authorising an onchain Arbitrum DAO vote to transfer the frozen ETH to LLC, with the restraining order following the funds upon transfer. No court has concluded that North Korea or Lazarus Group carried out the exploit. The legal process continues.

In the meantime, They confirmed it will borrow separate funds to cover the shortfall until the immobilised ETH is legally returned.

What Aave rsETH Recovery Phase II Means for You Now

The next steps directly affect anyone holding tokens or using affected markets. Here's the sequence:

• Liquidated rsETH on Arbitrum will be burned — permanently destroyed — to shrink the attacker's inflated supply

• Kelp DAO will retire the corresponding LayerZero message to block new tokens from minting on Ethereum

• Seized rsETH on Ethereum goes to the bridge lockbox to restore its backing

• Once the lockbox is backed, token withdrawals reopen and bridge operations resume

• It reverts all temporary protocol settings used to enable the liquidations

• The WETH loan-to-value ratio on V3 Ethereum Core — set to zero as a precaution — returns to normal soon

The recovery is roughly 90% complete. The remaining gap depends on the $71 million legal outcome and final ETH commitments from DeFi United. No exact timeline has been confirmed.

Two risks remain. The legal dispute could run for weeks. Aave's borrowed funding covers the gap but adds financial exposure the protocol didn't carry before the hack. The LayerZero-Kelp DAO blame dispute is also unresolved — Kelp DAO says LayerZero approved the vulnerable bridge setup, LayerZero CEO Bryan Pellegrino publicly denied it.

Conclusion

The Aave rsETH recovery has moved faster than most $293 million hacks ever do. Positions are liquidated. DeFi United is 90% funded. A court is handling the frozen $71 million. Aave is borrowing to cover the gap while the law catches up. The finish line is close — but it's a legal finish line now, not just a technical one.

YMYL Disclaimer: This article is an independent report based on market assumptions and public sources. It is not financial advice. No exact or guaranteed outcomes are provided. Always do your own research.