# rsETH Incident Recovery Technical Plan (Phase II) 

Source: https://x.com/aave/status/2052928584667275472?s=12

On April 28, we published a technical implementation plan to unwind the positions linked to the thief across Aave V3 on Ethereum Core and Arbitrum, restore the backing of rsETH, and normalize market conditions. The recovery has made meaningful progress since then, which we cover here along with the remaining steps.

Completed Steps

On May 6, the thief’s eight identified positions on Aave V3 were liquidated. The retrieved rsETH collateral was transferred to the Recovery Guardian as specified in the preceding AIP approved by Aave DAO governance. Other users (including Umbrella stakers) were not impacted by this process.

In parallel, governance proposals have also been passed by Mantle DAO and Arbitrum DAO. The Mantle DAO proposal confirming their participation in DeFi United passed with overwhelming support. The Arbitrum DAO proposal seeks to return to Aave protocol users the stolen $71 million in ETH recovered from the thief by Arbitrum’s Security Council for use in the DeFi United coalition’s recovery effort. The first proposal recently reached quorum and passed with overwhelming approval. We are continuing to work with the Arbitrum DAO on next steps.

On May 1, plaintiffs holding judgments against North Korea served a restraining notice on Arbitrum DAO, seeking to restrain the $71 million in ETH immobilized as part of the DeFi United recovery effort. Aave LLC filed an emergency motion to vacate the notice, and the Court soon after held a hearing on May 6.

Today, the plaintiffs submitted a letter to the judge. Aave LLC responded with its own letter, underscoring the urgency of the situation and requesting that this immobilized ETH, along with the restraining order, be transferred to Aave LLC. The judge accepted Aave LLC’s proposal, issuing an order authorizing an onchain Arbitrum DAO vote to move the immobilized ETH to Aave LLC, with the restraining order to follow and attach to Aave LLC upon transfer.

We are grateful to the judge for the time, care, and thoughtful questions she brought to the May 6 hearing, and for the seriousness with which she is weighing the arguments before her. As the judge deliberates, and in the meantime as a contingency, separate funds will be borrowed to cover the difference until the immobilized ETH are rightfully restored to Aave users. We will provide further updates as we are able, and we’ll continue to work on the recovery plan in parallel.

What Happens Next

The next phase of the plan focuses on restoring rsETH's backing and bringing affected markets back to normal operation.

On Arbitrum, the liquidated rsETH will be burned. Kelp will then retire the corresponding LayerZero packet (the pending cross-chain message that would otherwise mint rsETH on Ethereum) on Ethereum so that it cannot mint new rsETH on the receiving side. Together, these two steps neutralize the inflated rsETH supply created by the exploit.

On Ethereum, the seized rsETH will be sent to the bridge lockbox. Combined with committed ETH from the broader DeFi United coalition, these will be used to restore the backing of the rsETH lockbox contract. Once the lockbox is backed, the bridge can resume normal operation.

After backing is restored and the bridge is unlocked, rsETH withdrawals will reopen and the temporary configuration adjustments made on Aave to enable the liquidations will be reverted. Any remaining balances on the affected markets will be closed out using ETH recovered through the raised funds. In light of this plan, the LTV for WETH on Aave V3 Ethereum Core will be restored soon. Setting it to zero was precautionary, but given the progress made, it can return to normal.

Thank you to all the partners, DAOs, and DeFi community members that have helped and contributed to this colossal effort. We will continue to provide updates as these outlined steps are completed.