Key Takeaways:
- Aave froze rsETH reserves within hours of the April 18 Kelp DAO exploit, which created up to $230.1 million in bad debt.
- DeFi United raised $160M by April 25, with Mantle and Aave DAO pledging 55,000 ETH combined.
- Governance votes on Aave DAO’s 25,000 ETH contribution are ongoing as the protocol works to fully restore rsETH backing.
DeFi United Raises $160M to Backstop Aave
The exploit began at 17:35 UTC, at Ethereum block 24,908,285. Attackers targeted Kelp DAO’s Layerzero V2 bridge on the Unichain-to-Ethereum rsETH route, which was configured as a 1-of-1 DVN with no additional verifiers. They submitted a forged inbound packet that minted 116,500 unbacked rsETH tokens, valued at roughly $292 million at the time, without a corresponding lock or burn on the source chain.
The attacker moved quickly. About 89,567 rsETH, worth approximately $221 million, was deposited as collateral across Aave V3 markets on Ethereum and Arbitrum. The attacker then borrowed around 82,650 WETH, worth roughly $191 million, plus smaller amounts of wstETH.
Positions were left with health factors between 1.01 and 1.03, making full repayment unlikely. Aave‘s smart contracts were not exploited. The bad debt originated entirely from the unbacked external collateral.
Aave’s Protocol Guardian responded within hours. By approximately 19:00 UTC on April 18, all rsETH and wrsETH reserves across V3 deployments were frozen, loan-to-value ratios were set to zero, and interest rate models were adjusted to manage liquidity pressure.
Aave Labs and risk manager Llamarisk published a formal incident report on April 20. The report modeled two loss scenarios depending on how Kelp DAO socializes the shortfall. In the first scenario, a uniform haircut across all rsETH holders produces approximately $123.7 million in bad debt on Aave. In the second, losses isolated to L2 rsETH holders result in roughly $230.1 million in bad debt, with Mantle and Arbitrum bearing the heaviest exposure. Other estimates placed Aave’s total exposure between $196 million and $200 million.
The market responded sharply. Aave’s total value locked fell between $6 billion and $9 billion in the days following the incident. The price of AAVE dropped between 10% and 22% in the immediate aftermath. Broader DeFi TVL losses exceeded $13 billion in some reports.
To contain the fallout, Aave service providers launched DeFi United, a multi-protocol relief fund directing contributions to defiunited.eth, Ethereum address 0x0fCa5194baA59a362a835031d9C4A25970effE68. The fund targets the rsETH shortfall, initially modeled at 68,900 to over 100,000 ETH, depending on recoveries and final bad debt figures.
On Saturday, Arkham Intelligence confirmed DeFi United had raised $160 million. Mantle and Aave DAO together contributed 55,000 ETH, accounting for approximately $127 million of that total. Mantle proposed up to 30,000 ETH structured as a three-year credit facility at Lido staking yield plus 1%. Aave DAO has proposed 25,000 ETH from its treasury, with governance voting still in progress.
Aave founder and CEO Stani Kulechov committed 5,000 ETH from personal funds. Ether.fi pledged 5,000 ETH. Lido DAO offered up to 2,500 stETH. Smaller contributors include Golem Foundation at 1,000 ETH, Aave VP Emilio Frangella at 500 ETH, and community donations of more than 272 ETH reported onchain. Ethena, Layerzero, Ink Foundation, Frax, and Tydro also provided support.
The Arbitrum Security Council froze a portion of attacker funds, reducing the net gap the fund must cover. A follow-on malicious packet for 40,000 rsETH was reverted and recovered by Kelp before it could be processed.
DeFi United is described by participants as one of the largest coordinated recovery efforts in DeFi history. Governance votes on pending contributions remain active, and the fund continues to accept donations as the protocol works toward restoring full rsETH backing and clearing remaining bad debt.
