{"id":96894,"date":"2026-05-07T11:29:17","date_gmt":"2026-05-07T08:29:17","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=96894"},"modified":"2026-05-07T11:30:15","modified_gmt":"2026-05-07T08:30:15","slug":"aave-liquidates-hacker-kelps-positions","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/aave-liquidates-hacker-kelps-positions\/","title":{"rendered":"Aave Liquidates Hacker Kelp&#8217;s Positions"},"content":{"rendered":"<p>The leading lending protocol Aave has liquidated the remaining positions of <a href=\"https:\/\/forklog.com\/en\/news\/kelp-protocol-loses-293-million-following-cross-chain-bridge-attack\">hacker Kelp<\/a> in rsETH as part of the <a href=\"https:\/\/forklog.com\/en\/news\/defi-united-initiative-raises-over-300-million-following-kelp-hack\">approved recovery plan<\/a>.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">In line with the technical plan outlined below, the attacker&#8217;s rsETH positions on Aave have been liquidated on Ethereum and Arbitrum. The liquidated collateral now sits with the Recovery Guardian as specified in the AIP.<\/p>\n<p>No other users were affected, and Umbrella was also\u2026 <a href=\"https:\/\/t.co\/GQxroGuME0\">https:\/\/t.co\/GQxroGuME0<\/a><\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2052100832834036187?ref_src=twsrc%5Etfw\">May 6, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The funds obtained are transferred to a special multi-signature wallet managed by the DeFi United fund. The assets are used to restore rsETH collateral and compensate affected users.<\/p>\n<h2 class=\"wp-block-heading\">How the Liquidation Occurred<\/h2>\n<p>The attacker&#8217;s positions were placed in Aave versions on Ethereum and <a href=\"https:\/\/forklog.com\/en\/news\/what-is-arbitrum\">Arbitrum<\/a>. Community approval was required for their liquidation: over 90% of users supported the decision.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Thanks to the 1,600+ addresses representing over 190 million ARB tokens who have voted on unfreezing the ETH related to the April 18 rsETH incident, currently held by the Arbitrum DAO.<\/p>\n<p>Reaching quorum with a strong show of approval from delegates and the Arbitrum community is a\u2026 <a href=\"https:\/\/t.co\/mhIHH7iZ89\">pic.twitter.com\/mhIHH7iZ89<\/a><\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2052161175358517462?ref_src=twsrc%5Etfw\">May 6, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The DAO temporarily altered the rsETH oracle price to create a shortfall in the attacker&#8217;s position, and after the procedure was completed, parameters were returned to their original values.<\/p>\n<h2 class=\"wp-block-heading\">The Battle for 30,000 ETH<\/h2>\n<p>At the time of publication, the DeFi United initiative had attracted over $320 million from industry participants and users. The largest contribution came from the <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-layer%e2%80%912-solution-in-blockchain\">L2<\/a> network Arbitrum, which <a href=\"https:\/\/forklog.com\/en\/news\/arbitrum-freezes-30766-eth-amid-probe-into-kelp-hack\">froze<\/a> 30,766 ETH following the attack.<\/p>\n<p>In early May, the project&#8217;s DAO initiated a vote on transferring these funds to the fund. This move is supported by 90.5% of the community.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-fc0aa41ecc21807f-3743817951639389.webp\" alt=\"image\" class=\"wp-image-279663\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/snapshot.org\/#\/s:arbitrumfoundation.eth\/proposal\/0xb32581468bece42245fa267ea86156a621ae77f61bb866118189b5d50155b051\/votes\">snapshot.org<\/a>.<\/figcaption><\/figure>\n<p>The final decision was expected on May 7, but a New York court <a href=\"https:\/\/forklog.com\/en\/news\/new-york-court-bars-arbitrum-from-unfreezing-30000-stolen-eth\">prohibited<\/a> Arbitrum from disposing of the frozen coins. They are claimed by victims of North Korean terrorists, affected during the 2015 abductions.<\/p>\n<p>Aave <a href=\"https:\/\/forklog.com\/en\/news\/aave-seeks-court-order-to-release-30000-eth-seized-by-hackers\">called<\/a> the court&#8217;s logic legally unsound and demanded the lifting of restrictions. The plaintiffs&#8217; lawyers <a href=\"https:\/\/forklog.com\/en\/news\/lawyers-reclassify-north-korean-hack-of-kelp-as-credit-fraud\">questioned<\/a> the project&#8217;s right to challenge the freeze.<\/p>\n<p>Earlier on May 7, hackers <a href=\"https:\/\/forklog.com\/en\/news\/market-maker-trustedvolumes-hacked-for-6-million\">attacked<\/a> market maker TrustedVolumes and stole $6 million. This was the fifth breach since the beginning of the month.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The leading lending protocol Aave has liquidated the remaining positions of hacker Kelp in rsETH as part of the approved recovery plan.<\/p>\n","protected":false},"author":1,"featured_media":96895,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Aave liquidated hacker Kelp's rsETH positions under an approved recovery plan.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1212,44],"class_list":["post-96894","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-aave","tag-cybercrime"],"aioseo_notices":[],"amp_enabled":true,"views":"17","promo_type":"1","layout_type":"1","short_excerpt":"Aave liquidated hacker Kelp's rsETH positions under an approved recovery plan.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=96894"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96894\/revisions"}],"predecessor-version":[{"id":96896,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96894\/revisions\/96896"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/96895"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=96894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=96894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=96894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}