In response to a KelpDAO bridge exploit causing up to $230M in bad debt on Aave, DeFi United raised $160M within 7 days. Mantle and Aave DAO contributed 55,000 ETH, marking the largest coordinated recovery effort in DeFi history.
On April 18, 2026, attackers exploited a KelpDAO bridge vulnerability to mint unbacked rsETH, depositing it into Aave V3 and borrowing heavily, creating up to $230.1M in bad debt. DeFi United, a cross-protocol bailout fund, raised $160M within a week, with major contributions from Mantle, Aave DAO, and Stani Kulechov.
Layerzero Labs revealed that North Korea's Lazarus Group orchestrated an RPC poisoning and DDoS attack on its infrastructure, leading to the $292 million KelpDAO exploit. Only 0.36% of assets were affected; the team deployed enhanced security measures including 5/5 DVN defaults and a new multisig solution.
LayerZero said its internal RPC infrastructure was poisoned during the KelpDAO breach, which it linked to the Lazarus Group. The firm said the impact was limited but acknowledged critical security design shortcomings and announced major DVN and multisig upgrades.
Layerzero says North Korea-linked hackers compromised internal RPC infrastructure during the KelpDAO breach, affecting a limited portion of the ecosystem and prompting major DVN and multisig security upgrades.
A Llamarisk incident report says a LayerZero V2 bridge exploit involving KelpDAO’s rsETH let an attacker extract 116,500 rsETH without a corresponding burn, leaving Aave markets facing potential bad debt between $123.7 million and $230.1 million.
After KelpDAO lost 116,500 restaked ETH in a cross-chain message forgery attack, Charles Hoskinson argued that Cardano’s staking model and Midnight’s cryptographic design could reduce similar DeFi contagion risks.
After KelpDAO lost about $292 million in a forged cross-chain message attack, Charles Hoskinson argued that Cardano’s staking design and Midnight’s proof-based messaging model could help prevent similar contagion across DeFi lending markets.
