The actor behind the largest DeFi exploit of 2026 ultimately lost part of the stolen funds after protocol liquidations removed his positions.

How liquidations unfolded

After the April exploit, the attacker minted unsecured rsETH worth $293 million and used it to withdraw ETH from several DeFi protocols.

Following those transactions, Aave executed liquidations on the attacker’s leveraged exposure after a loan of approximately $123 million became undercollateralized.

To trigger liquidation, the protocol temporarily adjusted the rsETH price via its oracle, which caused the attacker’s positions on Ethereum and Arbitrum to show losses and be liquidated automatically.

Destination of seized assets

Assets recovered through the liquidations were transferred to Recovery Guardian, a fund managed by DeFi United that focuses on compensating users affected by exploits.

DeFi United will hold the seized funds within Recovery Guardian for the purpose of restitution to victims, according to the protocol’s announced procedure.

Background of the attack

In April the attacker exploited a bridge vulnerability in KelpDAO, creating unsecured rsETH to extract value across multiple protocols.

The sequence of minting and withdrawals resulted in on-chain transfers that prompted countermeasures and the subsequent liquidation events executed by Aave.

The incident highlights coordinated responses by DeFi actors and protocol-level tools that can reverse part of an exploit’s proceeds through price adjustments and liquidations.