A coordinated DeFi relief effort has raised $160 million to address the bad debt crisis at Aave following a sophisticated exploit of the KelpDAO bridge on April 18, 2026. The fund, named DeFi United, aims to cover losses from roughly 89,567 unbacked rsETH tokens that were deposited as collateral across Aave V3 markets on Ethereum and Arbitrum.
The exploit began at 17:35 UTC on Ethereum block 24,908,285. Attackers targeted KelpDAO's Layerzero V2 bridge on the Unichain-to-Ethereum rsETH route, which was configured as a 1-of-1 DVN without additional verifiers. They submitted a forged inbound packet that minted 116,500 unbacked rsETH tokens, valued at approximately $292 million at the time, without a corresponding lock or burn on the source chain.
Within hours, about 89,567 rsETH (worth ~$221 million) were posted as collateral on Aave V3 markets. The attacker then borrowed roughly 82,650 WETH (~$191 million) plus smaller amounts of wstETH. Positions were left with health factors between 1.01 and 1.03, making full repayment unlikely. Aave's smart contracts were not exploited; the bad debt stemmed solely from unbacked external collateral.
Aave's Response and Market Impact
Aave's Protocol Guardian reacted within hours, freezing all rsETH and wrsETH reserves across V3 deployments, setting loan-to-value ratios to zero, and adjusting interest rate models to manage liquidity pressure. Aave Labs and risk manager Llamarisk published a formal incident report on April 20, modeling two bad debt scenarios: a smooth haircut across all rsETH holders resulting in ~$123.7 million in Aave bad debt, or losses isolated to L2 rsETH holders causing ~$230.1 million in Aave bad debt. Other estimates placed Aave's total exposure between $196 million and $200 million.
The market reacted sharply. Aave's total value locked (TVL) fell between $6 billion and $9 billion in the days following the event. The price of AAVE dropped between 10% and 22% in the immediate aftermath. Broader DeFi TVL losses exceeded $13 billion in some reports.
DeFi United Bailout Fund Details
To contain contagion, Aave service providers launched DeFi United, a cross-protocol emergency liquidity fund directing contributions to defiunited.eth (Ethereum address 0x0fCa5194baA59a362a835031d9C4A25970effE68). The fund targeted the rsETH shortfall, initially modeled at 68,900 to over 100,000 ETH depending on recoveries and final bad debt figures.
On Saturday, Arkham Intelligence confirmed DeFi United had raised $160 million. Mantle and Aave DAO contributed 55,000 ETH together, representing roughly $127 million of the total. Mantle proposed up to 30,000 ETH structured as a three-year credit facility at Lido staking yield plus 1%. Aave DAO has proposed 25,000 ETH from its treasury, with governance voting still ongoing.
Additional contributors include: Aave founder and CEO Stani Kulechov committing 5,000 ETH from private funds; Ether.fi pledging 5,000 ETH; Lido DAO offering up to 2,500 stETH; Golem Foundation with 1,000 ETH; Aave VP Emilio Frangella with 500 ETH; and community donations of more than 272 ETH reported onchain. Ethena, Layerzero, Ink Foundation, Frax, and Tydro also provided support.
Recovery and Next Steps
The Arbitrum Security Council froze a portion of the attacker's funds, reducing the net gap the fund needs to cover. A subsequent malicious package for 40,000 rsETH was reversed and recovered by Kelp before it could be processed.
DeFi United is being described by participants as one of the largest coordinated recovery efforts in DeFi history. Governance votes on outstanding contributions remain active, and the fund continues to accept donations as the protocol works toward restoring full rsETH coverage and clearing remaining bad debt. Charles Hoskinson of Cardano commented on the incident, pointing to Cardano and Midnight as a solution for cross-chain failures behind the KelpDAO hack, which he broke down as a $292 million exploit that drained Ethereum escrow and triggered $13 billion in DeFi contagion.