In line with the technical plan outlined below, the attacker's rsETH positions on Aave have been liquidated on Ethereum and Arbitrum. The liquidated collateral now sits with the Recovery Guardian as specified in the AIP.
No other users were affected, and Umbrella was also untouched. This was a critical step in the recovery roadmap, with next steps to follow.