In an unprecedented coordinated effort within decentralized finance (DeFi), the DeFi United bailout fund has successfully raised $160 million to cover the bad debt crisis on Aave triggered by the exploitation of KelpDAO's cross-chain bridge.
On April 18, 2026, at 17:35 UTC, attackers exploited a vulnerability in KelpDAO's Layerzero V2 bridge connecting Unichain to Ethereum for rsETH transfers. The bridge was configured with a 1-of-1 DVN without additional validators, allowing the attacker to submit a forged inbound message that minted 116,500 unbacked rsETH tokens — worth approximately $292 million at the time — without a corresponding lock or burn on the source chain. The attacker swiftly deposited roughly 89,567 rsETH (valued at about $221 million) as collateral across Aave V3 markets on Ethereum and Arbitrum, then borrowed approximately 82,650 WETH (worth ~$191 million) plus smaller amounts of wstETH. These positions remained with health factors between 1.01 and 1.03, making full repayment highly unlikely.
Aave's Protocol Guardian reacted within hours. By approximately 19:00 UTC on April 18, all rsETH and wrsETH reserves across V3 deployments were frozen, loan-to-value (LTV) ratios were set to zero, and interest rate models were adjusted to manage liquidity pressure. On April 20, Aave Labs and risk manager Llamarisk published a formal incident report modeling two bad-debt scenarios. In the first, a smooth haircut across all rsETH holders results in roughly $123.7 million in bad debt on Aave. In the second, losses isolated to L2 rsETH holders lead to approximately $230.1 million in bad debt, with Mantle and Arbitrum bearing the largest exposure. Other estimates placed Aave's total exposure between $196 million and $200 million.
DeFi United Formation and Fundraising Progress
To contain systemic contagion, Aave service providers launched DeFi United, a cross-protocol bailout liquidity fund accepting contributions via the Ethereum address 0x0fCa5194baA59a362a835031d9C4A25970effE68. The fund targets the rsETH shortfall initially modeled at 68,900 to over 100,000 ETH, depending on recoveries and final bad-debt figures. By Saturday, April 25, blockchain analytics firm Arkham Intelligence confirmed that DeFi United had raised $160 million. Mantle and Aave DAO together contributed 55,000 ETH — approximately $127 million of the total. Mantle proposed up to 30,000 ETH structured as a three-year credit facility at Lido staking yield plus 1%. Aave DAO has proposed 25,000 ETH from its treasury, with governance voting still ongoing.
Aave founder and CEO Stani Kulechov committed 5,000 ETH from personal funds. Ether.fi pledged 5,000 ETH. Lido DAO offered up to 2,500 stETH. Smaller contributors include Golem Foundation with 1,000 ETH, Aave VP Emilio Frangella with 500 ETH, and on-chain community donations exceeding 272 ETH. Ethena, Layerzero, Ink Foundation, Frax, and Tydro also provided support. The Arbitrum Security Council froze a portion of the attacker's funds, reducing the net gap the fund must cover. Additionally, a subsequent malicious package for 40,000 rsETH was reversed and recovered by Kelp before it could be processed.
Market Impact and Broader Implications
The exploit had a severe market impact: Aave's total value locked (TVL) fell between $6 billion and $9 billion in the days following the event. The AAVE token price dropped 10% to 22% in the immediate aftermath. Some reports indicated broader DeFi TVL losses exceeding $13 billion. Participants describe DeFi United as one of the largest coordinated recovery efforts in DeFi history. Governance votes on outstanding contributions remain active, and the fund continues to accept donations as the protocol works toward restoring full rsETH coverage and eliminating remaining bad debt. In related commentary, Charles Hoskinson pointed to Cardano and Midnight as potential solutions to the cross-chain failures underlying the KelpDAO hack, emphasizing the need for more secure interoperability architectures.