rsETH operations resumed, but the balance-sheet gap remains
rsETH is functionally reopening, but the market still has a large hole to fill.
Kelp has restored the operational side of recovery by sending the final tranche to the LayerZero contract. That move gets transfers moving again, but full confidence still depends on whether backed supply and usable lending collateral catch up.
The bullish case is straightforward. DeFi United has secured sufficient ETH commitments to restore full backing and avoid socializing losses. The bearish case is that the original exploit still left 116,500 unbacked rsETH in circulation after the April 18 hack, while Aave and Compound are still dealing with a roughly $246 million bad-debt overhang.
That is why the rebound is only half won. Restored bridging and minting matter, but they do not erase the need to close the funding gap. Until clean backing replaces the bad-debt overhang, rsETH can rally on recovery headlines without fully regaining trust.
The bigger risk is still contagion, not the initial exploit
The hack was the shock. The longer-term risk is whether that shock stays contained.
The original failure exposed a structural weak point
The root cause was a 1-of-1 DVN setup that allowed a single DVN attestation to verify a forged inbound packet without a corresponding source-side burn. That matters because the market now has to price a broader lesson: when one attestor can unlock liquidity, the fallout can spread well beyond the affected protocol.
Security upgrades help, and Kelp now requires four independent attestors along with 64 block confirmations. But trust does not reset just because the configuration improved after the fact. Investors are no longer asking only whether the bridge was compromised; they are asking whether the wider lending stack can still be stressed by a weak link elsewhere.
What matters now is usable recovery, not just restored plumbing
The next readout is not a press release. It is whether recovered collateral actually returns to lending pools in usable form.
DeFi United's plan calls for controlled liquidation of the attacker's positions through a temporary rsETH oracle adjustment, with proceeds expected to restore about 13,000 ETH on Aave and 16,776 ETH on Compound. Recent reporting puts the recovered amount on Aave at roughly 13,900 ETH. That difference matters. If the recovered ETH becomes liquid and reusable, lending markets can stabilize quickly. If liquidations are sluggish or imperfectly priced, the market will keep carrying friction.
Why liquidity still needs to be repriced
Aave's reaction after the exploit shows how fast trust can turn into withdrawn collateral. After it absorbed approximately $196 million in bad debt, Aave's TVL fell from roughly $22 billion to $15.4 billion. That is the warning: a lending book can look solvent on paper while depositors still pull liquidity anyway.
So the next catalyst is simple: watch the unwinding. If recovered liquidity proves durable as positions close and pools refill, the contagion discount should shrink. If not, the market will keep treating rsETH recovery as incomplete, regardless of how clean the operational restart looks.
What would turn this into a real rebound
The rebound only becomes real if new funding beats withdrawal pressure.
The bullish case depends on dry powder becoming usable backing
DeFi United has raised more than $318M in Ethereum, giving the recovery more capital behind it than was available at the start of the cleanup. The market does not need another sympathy headline; it needs enough dry powder to absorb residual shortfalls without reopening the loss debate.
The complication is that the attacker has already moved about $175 million in ETH to fresh wallets, while Arbitrum also froze $71 million tied to the hack. Bulls can read that as a mixed signal: most funds are mobile, but some remain trapped. Bears can read it the other way: if money is moving off-chain into new wallets, recovery becomes a chase rather than a clean ledger fix.
What confirms the recovery
- Funding is fully delivered: commitments are not just sufficient in theory but fully deployed, as DeFi United has secured sufficient ETH commitments.
- Operations remain stable: rsETH operations in the coming days need to stay open, with normal mint, redeem, and bridge activity holding after restart.
- Lending stress eases: the key proof is whether Aave-style fallout stops deepening. After it absorbed approximately $196 million in bad debt, the market needs withdrawal pressure to fade, not another TVL wobble.
What would break the setup
If recovered ETH does not translate back into lending usability, or if the hacker's moved funds stay out of reach, the market is likely to treat this as a liquidity patch rather than a balance-sheet win. That is the difference between a headline-driven bounce and a durable rerating.
This is a conditional recovery trade only if capital inflow is confirmed, not just announced. If the next updates show funded backing plus stable operations, the setup improves quickly. If not, the market is still dealing with an unfinished repair.