Aave DeFi United rescue mobilizes $300M after Kelp DAO’s $293M exploit, aiming to cover bad debt, restore rsETH backing, and stabilize DeFi.
Author: Kritika Gupta
Steady attention without excessive speculation.
28th April 2026- The Aave DeFi United rescue has emerged as a critical response to one of the largest DeFi exploits of 2026. In a rare show of cross-protocol coordination, Aave is leading a recovery initiative called “DeFi United” after the April 18 exploit of Kelp DAO. The attack drained roughly $293 million in rsETH and created a major wave of bad debt across lending markets.
As a result, leading DeFi players quickly mobilized. Over $303 million in pledges and credit support has already been committed by firms such as Consensys, Lido, and EtherFi. This rapid response has helped contain immediate contagion risks, although governance approvals are still pending.
High Signal Summary For A Quick Glance
Jacquelyn Melinek
@jacqmelinek
April has been hard for DeFi exploits. But it's clear from @Aave's DeFi United relief effort that good actors in the community will show up and support one another. Over $300 million raised across 116K+ wallets and counting. Love to see it. https://t.co/uaSfRcAsBc
11:28 PM·Apr 27, 2026
On April 18, 2026, attackers exploited a vulnerability in Kelp DAO’s cross-chain bridge built on LayerZero. Specifically, they compromised a single-verifier setup and injected a malicious message through infected RPC nodes.
Consequently, the attackers drained 116,500 rsETH, which accounted for about 18 percent of the circulating supply. They then deposited the stolen tokens into Aave V3 and borrowed more than $236 million in WETH.
However, the collateral was effectively unbacked. Therefore, liquidation mechanisms failed, leaving Aave with an estimated $195 million to $230 million in bad debt. In response, platforms including Aave and SparkLend froze rsETH markets, while panic withdrawals triggered billions in total value locked outflows.
At the same time, this exploit fits into a broader pattern. Earlier in April 2026, the Drift Protocol hack caused $285 million in losses. In addition, smaller exploits pushed total monthly losses above $600 million. Historically, events like the 2023 Curve Finance exploit and the 2021 Cream Finance breach have shown similar systemic stress.
As expected, markets reacted sharply. DeFi TVL dropped significantly, utilization rates surged, and borrowing costs spiked. Meanwhile, the AAVE token fell more than 20 percent in the days following the incident. Over $15 billion exited DeFi protocols during the initial panic phase.
To stabilize the system, the DeFi United initiative has already secured around 132,650 ETH, valued at roughly $303 million. This includes a mix of direct funding, credit lines, and token purchases, forming the backbone of the Aave DeFi United rescue.
Key contributors include Joseph Lubin and Consensys with up to 30,000 ETH, Mantle with a 30,000 ETH credit facility, and the Aave DAO with a proposed 25,000 ETH allocation. Additionally, EtherFi, Lido, and Aave founder Stani Kulechov have committed meaningful support.
The recovery plan focuses on three priorities. First, it aims to repurchase and retire unbacked rsETH. Second, it seeks to cover Aave’s bad debt. Third, it intends to unlock approximately 30,000 ETH currently frozen on Arbitrum.
Importantly, this marks the first large-scale effort where competing DeFi protocols have pooled capital to absorb losses from an external exploit. Therefore, it introduces a new model of collective risk management in decentralized finance.
This incident highlights a key contradiction in DeFi. On one hand, cross-chain infrastructure continues to present critical vulnerabilities. On the other hand, the ecosystem is demonstrating stronger coordination and crisis response capabilities.
In the short term, the $300 million backstop has reduced systemic risk and prevented a deeper liquidity collapse. However, volatility remains elevated, and governance approvals could still delay execution.
Looking ahead, a successful recovery could rebuild user confidence and establish a precedent for protocol-level insurance mechanisms. Nevertheless, risks remain. These include legal uncertainties around frozen funds, governance friction, and the potential for further exploits.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Aave
