Aave Clears the Hacker's rsETH Collateral, and Recovery Now Depends on Governance and Legal Tim

## After Aave's liquidation step, recovery shifts from mechanics to legal and governance execution  According to [Cointelegraph](https://cointelegraph.com/news/aave-liquidates-kelp-dao-hackers-rseth-stash-ethereum-arbitrum), Aave Labs liquidated the attacker's remaining rsETH collateral on Ethereum and Arbitrum and transferred collateral tied to the April 18, $293 million exploit into the Recovery Guardian multisig managed by DeFi United. That closes an important mechanical stage and opens a more complex execution stage. ## Verifiable anchors now point to a smaller gap but a harder final mile Public statements cited in the report indicate DeFi United is now about 10% short of the Ether needed to restore rsETH backing. This suggests liquidation throughput has improved, but the final restoration still depends on assets that are not yet freely deployable. ### 13,000 ETH was a release path, while 30,765 ETH remains in legal limbo Aave said on April 28 that clearing collateral positions on Ethereum and Arbitrum could release around 13,000 ETH, then valued near $30.2 million. Separately, another 30,765 ETH remains frozen after a restraining notice filed by Gerstein Harrow LLP, creating a legal bottleneck around redistribution by Arbitrum DAO. In practical terms, technical settlement and legal enforceability are moving on different clocks.  ### Governance voting and court process now run in parallel The same report says more than 90% of Arbitrum DAO votes were in favor of releasing frozen ETH to the recovery fund, with voting set to close on Friday. Even with strong governance support, completion timing still depends on legal clearance and capital commitments from counterparties. ## The larger market signal is credit-system reliability, not one-day price behavior The Kelp DAO incident pushed more than $190 million of bad debt onto Aave after stolen rsETH was used as collateral to borrow wrapped Ether, and total value locked fell by nearly $12 billion in a week. DefiLlama data cited in the report then showed TVL rebounding from around $14.2 billion on April 26 to above $15 billion. The key reading is structural: recovery quality depends on whether bad-debt resolution, governance execution, and legal finality advance together. ### Practical monitoring framework for the next phase 1. **Legal checkpoint**: whether the restraining notice is vacated and asset-release timing becomes concrete. 2. **Governance checkpoint**: whether post-vote execution follows a defined timeline. 3. **Capital checkpoint**: whether external commitments are delivered in sequence. 4. **Protocol checkpoint**: whether net outflows continue to ease while TVL recovery remains stable. When these four checkpoints align, recovery credibility improves materially. If they diverge, DeFi risk pricing is likely to retain a discount. --- Author: Coinalx Editorial Team｜First published: 2026-05-07 | Last updated: 2026-05-07 Source: [cointelegraph.com](https://cointelegraph.com/news/aave-liquidates-kelp-dao-hackers-rseth-stash-ethereum-arbitrum)