The DeFi sector is mounting one of its largest coordinated recovery efforts after the KelpDAO bridge exploit left Aave facing a major bad debt problem. According to Arkham Intelligence, DeFi United had raised $160 million by April 25 to help cover the rsETH shortfall and support Aave’s ongoing recovery process.
How the exploit created bad debt
The attack began on April 18, 2026, when attackers exploited a configuration weakness in Kelp DAO’s Layerzero V2 bridge on the Unichain-to-Ethereum rsETH route. By submitting a forged inbound message, they minted 116,500 unbacked rsETH, worth about $292 million at the time, without any corresponding lock or burn on the source chain. The attackers then moved quickly, depositing roughly 89,567 rsETH as collateral into Aave V3 markets on Ethereum and Arbitrum.
Against that collateral, they borrowed around 82,650 WETH, valued at approximately $191 million, along with smaller amounts of wstETH. Aave’s own smart contracts were not directly exploited, according to the incident analysis. Instead, the bad debt emerged because the external collateral posted to the protocol had no real backing. With health factors sitting in the 1.01 to 1.03 range, the positions were viewed as highly unlikely to be fully repaid. Within hours, Aave froze rsETH and wrsETH reserves across V3 deployments and adjusted risk parameters to contain further damage.
Loss estimates and market impact
A formal report released on April 20 by Aave Labs and risk manager Llamarisk modeled two potential loss paths. In one scenario, if Kelp DAO spread the deficit evenly across all rsETH holders, Aave’s bad debt would come to about $123.7 million. In a second scenario, where losses for L2 rsETH holders were more limited, the bad debt could reach roughly $230.1 million. Other estimates placed Aave’s total exposure in a range of $196 million to $200 million.
The market reaction was severe. In the days following the incident, Aave’s total value locked dropped into the $6 billion to $9 billion range, while the AAVE token fell 10% to 22% shortly after the event. Some reports also suggested that broader DeFi TVL losses briefly exceeded $13 billion, underlining the wider confidence shock caused by the exploit.
Who is funding the recovery
To contain the fallout, Aave service providers helped launch DeFi United, a multi-protocol relief fund that accepts contributions to a designated onchain address. Of the current total, Mantle and Aave DAO have together pledged 55,000 ETH, representing about $127 million. Mantle’s support includes up to 30,000 ETH structured as a three-year credit line priced at Lido staking yield plus 1%. Aave DAO has proposed contributing 25,000 ETH from treasury assets, though governance voting on that commitment remains ongoing.
Other backers have also stepped in. Aave founder and CEO Stani Kulechov committed 5,000 ETH from personal funds, Ether.fi pledged another 5,000 ETH, and Lido DAO offered up to 2,500 stETH. Additional support came from the Golem Foundation, Aave executive Emilio Frangella, and community donors. Meanwhile, the Arbitrum Security Council froze part of the attacker’s funds, reducing the net shortfall that the industry rescue effort must absorb. A separate malicious packet involving 40,000 rsETH was also reversed and recovered by Kelp before it could be processed.
For now, DeFi United stands as one of the biggest coordinated rescue initiatives in DeFi history. With governance votes still active and donations continuing, the broader goal remains clear: restore full rsETH backing and eliminate as much of Aave’s remaining bad debt as possible.