DeFi United Raises $160M to Backstop Aave After rsETH Exploit

DeFi United collected $160 million by April 25 to help cover losses after an April 18 exploit of KelpDAO’s rsETH bridge that produced 116,500 unbacked rsETH and created heavy exposure on Aave V3 markets.

The incident began at 17:35 UTC in Ethereum block 24,908,285 when a forged inbound packet on KelpDAO’s LayerZero V2 Unichain-to-Ethereum rsETH route, configured with a single verifier, minted 116,500 rsETH without a corresponding lock or burn on the source chain. The attacker deposited about 89,567 rsETH, roughly $221 million at the time, into Aave V3 markets on Ethereum and Arbitrum as collateral and borrowed approximately 82,650 WETH, near $191 million, plus smaller amounts of wstETH. The resulting positions had health factors around 1.01 to 1.03.

Aave’s smart contracts were not exploited. Aave Labs and risk manager Llamarisk published an incident report on April 20 modeling two loss scenarios. A uniform haircut across all rsETH holders would produce roughly $123.7 million in bad debt on Aave. If losses were isolated to L2 rsETH holders, bad debt could reach about $230.1 million, with Mantle and Arbitrum the most exposed. Other estimates put Aave’s exposure between $196 million and $200 million.

Aave’s Protocol Guardian froze rsETH and wrapped rsETH reserves across V3 deployments by about 19:00 UTC on April 18, set loan-to-value ratios for rsETH to zero and adjusted interest rate models to manage liquidity stress. The Arbitrum Security Council froze a portion of attacker funds. KelpDAO reverted a follow-on malicious packet for 40,000 rsETH before it was processed and recovered those tokens.

DeFi United pooled protocol and individual contributions to the address defiunited.eth (0x0fCa5…). By April 25 the fund had $160 million in pledges. Mantle and Aave DAO together pledged 55,000 ETH, about $127 million of the total. Mantle proposed up to 30,000 ETH structured as a three-year credit facility at Lido staking yield plus 1%. Aave DAO proposed a 25,000 ETH contribution from its treasury; that contribution is subject to an ongoing governance vote.

Other pledges include 5,000 ETH from Aave founder Stani Kulechov, 5,000 ETH from Ether.fi, up to 2,500 stETH from Lido DAO, 1,000 ETH from the Golem Foundation, 500 ETH from Aave VP Emilio Frangella, and more than 272 ETH in community donations reported on-chain. Additional support came from Ethena, LayerZero, Ink Foundation, Frax, and Tydro.

The market impact was immediate. Aave’s total value locked dropped between $6 billion and $9 billion in the days after the exploit. The AAVE token lost between 10% and 22% of its value in the immediate aftermath. Some reports showed broader DeFi total value locked falling by more than $13 billion.

Governance votes on Aave DAO’s contribution remain active and DeFi United continues to accept donations as participants work to restore rsETH backing and clear remaining bad debt.