Aave Leads $300M DeFi United Rescue After KelpDAO Hack

Background and Context

On April 18, 2026, attackers exploited a vulnerability in Kelp DAO’s cross-chain bridge built on LayerZero. Specifically, they compromised a single-verifier setup and injected a malicious message through infected RPC nodes.

Consequently, the attackers drained 116,500 rsETH, which accounted for about 18 percent of the circulating supply. They then deposited the stolen tokens into Aave V3 and borrowed more than $236 million in WETH.

However, the collateral was effectively unbacked. Therefore, liquidation mechanisms failed, leaving Aave with an estimated $195 million to $230 million in bad debt. In response, platforms including Aave and SparkLend froze rsETH markets, while panic withdrawals triggered billions in total value locked outflows.

At the same time, this exploit fits into a broader pattern. Earlier in April 2026, the Drift Protocol hack caused $285 million in losses. In addition, smaller exploits pushed total monthly losses above $600 million. Historically, events like the 2023 Curve Finance exploit and the 2021 Cream Finance breach have shown similar systemic stress.

As expected, markets reacted sharply. DeFi TVL dropped significantly, utilization rates surged, and borrowing costs spiked. Meanwhile, the AAVE token fell more than 20 percent in the days following the incident. Over $15 billion exited DeFi protocols during the initial panic phase.

DeFi United: Pledges, Mechanics, and Key Players

To stabilize the system, the DeFi United initiative has already secured around 132,650 ETH, valued at roughly $303 million. This includes a mix of direct funding, credit lines, and token purchases, forming the backbone of the Aave DeFi United rescue.

Key contributors include Joseph Lubin and Consensys with up to 30,000 ETH, Mantle with a 30,000 ETH credit facility, and the Aave DAO with a proposed 25,000 ETH allocation. Additionally, EtherFi, Lido, and Aave founder Stani Kulechov have committed meaningful support.

The recovery plan focuses on three priorities. First, it aims to repurchase and retire unbacked rsETH. Second, it seeks to cover Aave’s bad debt. Third, it intends to unlock approximately 30,000 ETH currently frozen on Arbitrum.

Importantly, this marks the first large-scale effort where competing DeFi protocols have pooled capital to absorb losses from an external exploit. Therefore, it introduces a new model of collective risk management in decentralized finance.

Implications for DeFi

This incident highlights a key contradiction in DeFi. On one hand, cross-chain infrastructure continues to present critical vulnerabilities. On the other hand, the ecosystem is demonstrating stronger coordination and crisis response capabilities.

In the short term, the $300 million backstop has reduced systemic risk and prevented a deeper liquidity collapse. However, volatility remains elevated, and governance approvals could still delay execution.

Looking ahead, a successful recovery could rebuild user confidence and establish a precedent for protocol-level insurance mechanisms. Nevertheless, risks remain. These include legal uncertainties around frozen funds, governance friction, and the potential for further exploits.