Aave Leads DeFi United Rescue After $292M KelpDAO Exploit

DeFi United, a coordinated rescue effort led by Aave, is now the industry’s answer to one of the ugliest weeks DeFi has had in years. The initiative pulls together a who’s-who of lending and staking protocols trying to plug a hole left by the April 18 KelpDAO exploit, which drained $292 million from a cross-chain bridge and dumped somewhere between $123.7 million and $230.1 million of bad debt onto Aave’s books. No one is pretending this is business as usual.

What Is DeFi United and Why Did Aave Launch It?

DeFi United is a voluntary, multi-protocol relief fund that restores the backing of rsETH and stops the KelpDAO fallout from cascading through Aave’s markets. Aave founder Stani Kulechov put it in motion on Wednesday with a public pledge of his own ETH, aiming to halt liquidations before they punish innocent users.

Kulechov did not mince words. “Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” he wrote in a post announcing his contribution. “I’m personally contributing 5,000 ETH to DeFi United as we continue working together with partners on formalizing more commitments.”

That kind of personal skin-in-the-game from a protocol founder is rare. It is also, read cynically, a signal of how bad the numbers look behind the scenes. You do not pledge five thousand ETH of your own money if a spreadsheet would fix the problem.

Aave service providers have been leading the DeFi United effort to restore rsETH’s backing since the April 18 incident. We believe ecosystem collaboration matters most in moments like this.

How the KelpDAO Exploit Actually Happened

The attack traces back to a configuration flaw in Kelp’s LayerZero bridge. It used a single-verifier setup, a design choice security teams have warned about for years, and that choice turned out to be the whole ball game. Investigators have attributed the breach to North Korean hackers, the same state-linked crews that have become DeFi’s most persistent headache.

Once inside, the attackers minted 116,500 rsETH out of thin air. Those tokens had no real backing. But Aave’s smart contracts, which rely on oracles and collateral configs, saw them as the real thing. The exploiter then posted the unbacked rsETH as collateral and borrowed roughly $190 million in legitimate stablecoins and ETH. For a full rundown of the bridge mechanics, Chainalysis published a detailed KelpDAO exploit post-mortem this week.

The fallout was immediate. More than $10 billion in net withdrawals flooded out of Aave in a matter of days as depositors raced to get out before whatever came next. The Arbitrum Security Council later froze 30,766 ETH worth $71.5 million linked to the exploiter’s wallet after law enforcement shared information about the attacker’s identity.

The frozen funds are now parked in an intermediary wallet and can only be moved by further Arbitrum governance action. That is a partial recovery, at best. It does not come close to closing the gap.

Mantle’s MIP-34 and the Loan to Aave DAO

Mantle’s core team put the biggest number on the table. Their draft proposal, MIP-34, outlines a credit facility of up to 30,000 ETH extended to Aave DAO. Structured as a loan, not a gift. Interest is set at Lido’s stETH rate plus 1%, repayable over as long as 36 months.

Bybit co-founder Ben Zhou, whose exchange is the largest stakeholder in Mantle, said the vote is a yes. He framed it bluntly in a post on Thursday.

That reciprocity matters. When Bybit was hacked earlier, the industry coordinated to help it absorb the shock. Zhou is making sure that memory does not fade.

When we got hacked the industry got together and helped us. It is the only right thing that we do the same to unit together and walk out from difficult times.

Who Else Is Writing Checks?

The list of contributors keeps growing, and the pledges so far run the gamut from small foundation grants to large DAO treasury motions. Not every commitment is formalized. Some are still in governance limbo. Taken as a whole, though, it is the most coordinated multi-protocol response DeFi has ever produced for a single incident.

Here is what has been pledged or proposed so far:

• Aave founder Stani Kulechov, 5,000 ETH personal contribution
• Mantle, up to 30,000 ETH via MIP-34 credit facility
• Lido Finance contributors, up to 2,500 stETH, conditional on the relief vehicle being fully funded
• Golem Foundation and Golem Factory, combined 1,000 ETH
• Ether.fi, governance vote pending to deploy 5,000 ETH from DAO treasury
• Tydro, Ethena, Frax Finance, LayerZero, commitments announced without firm figures yet

The Circle Intervention That Split the Room

Circle’s chief economist Gordon Liao floated the most contentious idea of the week. On Wednesday, he proposed raising Aave’s USDC borrowing cap from 14% to 50% to break the liquidity freeze that has left users’ funds stuck on the protocol for five days running. Circle CEO Jeremy Allaire amplified the pitch.

Liao’s argument is that a massive interest-rate hike would jolt the system back into balance by pushing borrowers to repay. After users took out huge stablecoin loans to get ahead of the KelpDAO fallout, quadrupling the maximum rate is, in his reading, the shock therapy the market needs. It is a classic central-banker move dropped into a DeFi governance forum.

Not everyone is buying it. Some governance participants warned that a rate shock of that size could trigger exactly the liquidations the rescue is trying to avoid. Push rates too hard and you accelerate the very cascade DeFi United is trying to contain.

How Much Aave Bad Debt Is Actually Left?

Estimates of the shortfall vary, but none of them are small. The Aave bad debt tracker being maintained on the governance forum puts the final hole at somewhere between $123.7 million and $230.1 million, depending on recovery assumptions and market moves in rsETH.

The range exists because a few variables remain live. The frozen $71.5 million from Arbitrum may or may not be returned to depositors. The Lido contribution is conditional. And the total damage depends on whether rsETH finds a new floor or continues to bleed against ETH as the market digests what happened.

If every pledge lands and every conditional contribution clears governance, the gap closes. If half of them stall in DAO votes over the next month, Aave is looking at real structural losses.

What the Experts Are Saying

The response has pulled in both cautious optimism and a lot of structural skepticism. Matthew Pinnock, COO at Altura DeFi, said the effort shows the industry “moving beyond isolated protocols to a more coordinated financial system,” but he stopped short of declaring it a template worth copying.

Others were more pointed. Georgii Verbitskii, founder of yield platform TYMIO, said the plan still lacks specifics. “At this stage, there are still very few concrete details about the initiative,” he said. “Without clarity on what it will actually involve, it’s difficult to expect any meaningful structural shift in DeFi.”

Verbitskii thinks the market will retreat toward “more conservative, base-layer configurations” as investors realize that chasing a few extra percentage points of yield can carry disproportionate risk. Wrapped products and liquid staking derivatives, he said, may see reduced demand as a direct consequence of this week.

The more upbeat read came from Sergey Kravtsov, CEO of Papaya Finance, who called the coordinated response “an emergent immune response of a financial system that is actually decentralized.” Competing protocols stepped in voluntarily, he argued, because letting bad debt cascade would have hurt everyone.

Socialised recovery methods are important in a moment of crisis, but the focus should always be on clear rules and accountability.

What Comes Next for rsETH and DeFi Collateral Standards?

Pinnock thinks the industry will move toward “standardised collateral onboarding frameworks that require independent attestation of backing.” The verification has to be enforced from onboarding, he said, not discovered missing later down the line. That is a direct shot at the config-level failure that enabled the KelpDAO exploit in the first place.

For depositors, the immediate question is simpler. Do the pledges actually clear governance? Stani’s 5,000 ETH is locked in. MIP-34 still has to pass. Ether.fi still has to vote. Lido’s stETH is conditional. Until those motions close, the hole stays open.

Call it a crisis, call it an immune response, call it DeFi finally growing up. The honest answer is that it is all three at once, and the bill is still being counted.

This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.