Compound Protocol Liquidates rsETH Attacker Positions to Secure Markets

The Compound Foundation has confirmed the successful liquidation of high-risk positions linked to the recent rsETH security incident. Following a coordinated effort with industry partners, the protocol neutralized the exploiter's influence on the Ethereum-based Comet markets. This decisive action has allowed for the full restoration of normal operations, ensuring that supplier funds and protocol reserves remain protected from further volatility or manipulation.

Coordinated Liquidation and Market Mitigation

The recovery process was a collaborative endeavor involving the Compound, Aave, and KelpDAO teams. Over the weekend of May 10-11, 2026, the WETH and wstETH Comet positions controlled by the rsETH exploiters were systematically liquidated. By offloading these positions, the protocol effectively mitigated the systemic risks that had briefly threatened the stability of its lending pools.

Liquidations in decentralized finance (DeFi) serve as a fail-safe mechanism to ensure that undercollateralized positions do not result in bad debt for the protocol.

As part of the resolution, the rsETH tokens previously held by the attacker were transferred to DeFi United, an organization often involved in the remediation of cross-protocol security breaches. This transfer ensures that the assets are no longer under the control of the malicious actor.

Restoration of Normal Operations

Following the successful liquidation, the Compound Foundation moved to lift previous security measures that had restricted user activity. The specific impacts of this restoration include:

• The removal of transfer restrictions for WETH and wstETH Comet on the Ethereum mainnet.
• The resumption of full functionality across all Comet markets, including deposits and withdrawals.
• The stabilization of the COMP ecosystem reserve funds, which were utilized as a backstop during the incident.

The swift action effectively mitigated market risks and protected the security of the protocol's suppliers and reserve funds.

Industry-Wide Security Implications

The incident highlights the growing interdependence of Liquid Restaking Tokens (LRTs) like rsETH within the broader DeFi landscape. The rapid response from multiple Decentralized Autonomous Organizations (DAOs) underscores a shift toward collaborative security frameworks. By neutralizing the exploiter's leverage within the Compound v3 architecture, the teams involved prevented potential contagion that could have affected other lending platforms utilizing similar collateral types.

The Compound Foundation has reiterated its commitment to monitoring market health and maintaining the integrity of its collateral tiers. Users of the Ethereum WETH and wstETH markets can now interact with the protocol without the temporary limitations imposed during the remediation phase. No further losses to supplier capital have been reported following the completion of the liquidation process.