Ether Withdrawals: A Farce Concludes with a Token Bonfire

Ah, the sweet scent of resolution wafts through the digital ether as KelpDAO users, those poor souls, are finally permitted to retrieve their precious Ether within the next 24 hours. A coordinated bonfire of the attacker’s rsETH tokens on Arbitrum has, with a flourish of cryptographic pyrotechnics, neutralized the exploit’s impact. How quaint.

  • Key Takeaways (for the uninitiated):

  • The rsETH attacker’s Arbitrum tokens were ceremoniously burned today, following the liquidation of 8 Aave V3 positions on May 6. A financial auto-da-fé, if you will.
  • Aave co-founder Stani Kulechov, with the gravitas of a man who’s just survived a weekend in the trenches, confirmed ETH withdrawals will normalize within 24 hours of this Arbitrum conflagration.
  • Recovery, alas, is complicated by a U.S. court’s prior freeze on $71M in ETH, allegedly linked to North Korea’s Lazarus Group. Because nothing says “decentralized finance” like a touch of international espionage.

MORE THAN A MERE EXPLOIT

The rsETH bridge lockbox on Arbitrum is being replenished, and ether withdrawals for the unfortunate souls affected by the KelpDAO exploit are expected to commence within 24 hours. This marks the final act in one of decentralized finance’s (or DeFi, if you’re in a hurry) most elaborate and farcical recoveries. Aave’s Stani Kulechov, with the air of a man who’s just emerged from a particularly trying season of Downton Abbey, confirmed the development, noting the past weeks have been “incredibly intense.” One can only imagine the tea consumption.

Image source: X

The drama began on April 18, when an anonymous miscreant exploited KelpDAO’s Layerzero bridge-a cross-chain messaging system, no less-and fraudulently minted 116,500 rsETH tokens without the bother of backing them with real assets. How very modern.

This scoundrel then deposited roughly 89,500 of these tokens into Aave V3 as collateral and borrowed wrapped ether against them, amassing over $190 million in undercollateralized positions. Aave V3, poor dear, was left exposed to up to $230 million in potential losses. However, Aave’s community, with the swiftness of a dowager dispatching a scandalous rumor, froze rsETH markets on both Ethereum and Arbitrum to contain the damage.

LIQUIDATION AND THE GREAT TOKEN BONFIRE

Recovery commenced in earnest on May 6, when the attacker’s eight positions on Aave V3 were liquidated across Ethereum and Arbitrum. As part of Phase II of this financial melodrama, the liquidated rsETH on Arbitrum has been burned, permanently removing the fraudulently minted tokens from circulation and restoring a modicum of integrity to the rsETH supply. The rsETH bridge lockbox is being refilled to back the remaining supply at a 1:1 ratio against ether. How very reassuring.

As Bitcoin.com News reported last week, a U.S. federal judge cleared the transfer of $71 million in recovered ETH to Aave, lifting a freeze imposed after a U.S. law firm filed a restraining notice claiming the funds were linked to North Korea’s Lazarus Group. Because, of course, no financial farce is complete without a dash of international intrigue.

With the Arbitrum bonfire complete and the lockbox replenished, ether withdrawals for rsETH holders are expected to resume within 24 hours, per Kulechov’s latest update. ETH loan-to-value (LTV) ratios on Aave are already returning to normal, and liquidity is expected to normalize as the market absorbs the resumed withdrawals. How very convenient.

The coordinated response, involving Aave governance, KelpDAO, and legal channels, has been one of the more elaborate multi-party recoveries the ecosystem has managed. And, though the final loss tally remains as clear as a London pea soup, the structural damage from unbacked rsETH minting has been contained. Bravo, one supposes.

Read More

2026-05-13 14:29