A coordinated rescue effort in decentralized finance (DeFi) has reportedly raised $160 million to cover the bad debt that emerged after attackers exploited KelpDAO’s bridge and deposited unsecured collateral into Aave V3 markets on April 18, 2026.
How the Exploit Unfolded
The exploit began at 17:35 UTC on Ethereum block 24,908,285. Attackers targeted KelpDAO’s Layerzero V2 bridge on the Unichain-to-Ethereum rsETH route, which was configured as a 1-of-1 DVN without additional verifiers. They submitted a forged inbound packet that minted 116,500 unbacked rsETH tokens, valued at approximately $292 million at the time, without a corresponding lock or burn on the source chain.
The attacker acted swiftly, depositing about 89,567 rsETH (worth around $221 million) as collateral across Aave V3 markets on Ethereum and Arbitrum. They then borrowed roughly 82,650 WETH (about $191 million) plus smaller amounts of wstETH. The positions were left with health factors between 1.01 and 1.03, making full repayment unlikely. Aave’s smart contracts were not exploited; the bad debt stemmed solely from the unsecured external collateral.
Immediate Response and Risk Assessment
Aave’s Protocol Guardian reacted within hours, freezing all rsETH and wrsETH reserves across V3 deployments, setting loan-to-value ratios to zero, and adjusting interest rate models to manage liquidity pressure. Aave Labs and risk manager Llamarisk published a formal incident report on April 20, modeling two bad-debt scenarios: a uniform haircut across all rsETH holders would result in about $123.7 million in bad debt on Aave, while isolation of losses to L2 rsETH holders would lead to approximately $230.1 million. Other estimates placed Aave’s total exposure between $196 million and $200 million.
The market reacted sharply: Aave’s total value locked (TVL) fell between $6 billion and $9 billion in the days following, the price of AAVE dropped 10% to 22%, and broader DeFi TVL losses exceeded $13 billion in some reports.
DeFi United Mobilizes $160 Million
To contain the contagion, Aave service providers launched DeFi United, a cross-protocol rescue liquidity fund directing contributions to defiunited.eth (Ethereum address 0x0fCa5194baA59a362a835031d9C4A25970effE68). By Saturday, April 25, Arkham Intelligence confirmed that DeFi United had raised $160 million. Mantle and Aave DAO jointly contributed 55,000 ETH, accounting for approximately $127 million of the total. Mantle proposed up to 30,000 ETH structured as a three-year credit facility at Lido staking yield plus 1%, while Aave DAO proposed 25,000 ETH from its treasury (governance vote ongoing).
Aave founder and CEO Stani Kulechov committed 5,000 ETH from personal funds. Ether.fi pledged 5,000 ETH. Lido DAO offered up to 2,500 stETH. Smaller contributors include Golem Foundation with 1,000 ETH, Aave VP Emilio Frangella with 500 ETH, and community donations of more than 272 ETH reported on-chain. Ethena, Layerzero, Ink Foundation, Frax, and Tydro also provided support.
The Arbitrum Security Council froze a portion of the attacker’s funds, reducing the net gap the fund must cover. A subsequent malicious packet for 40,000 rsETH was reversed and recovered by Kelp before it could be processed. DeFi United is described by participants as one of the largest coordinated recovery efforts in DeFi history. Governance votes on outstanding contributions remain active, and the fund continues to accept donations as the protocol works toward restoring full rsETH coverage and clearing remaining bad debts.