Aave raises most of $200M exploit debt

TLDR

Aave and partners have raised most of the roughly 200 million dollars in bad debt created by the recent KelpDAO rsETH exploit, easing immediate solvency fears.

1. Attackers exploited KelpDAOs rsETH bridge, leaving Aave with around 196 to 230 million dollars in bad debt after borrowing against unbacked collateral.
2. A coordinated DeFi United campaign has raised about 160 million dollars, roughly 80 percent of the target, mainly via large ETH commitments from Mantle, Aave maker/">DAO and other DeFi projects.
3. The big unknowns are who ultimately eats the remaining losses, how Aave governance treats mainnet versus L2 users, and whether confidence and TVL flow back to Aave.

Deep Dive

1. Exploit Mechanics And Debt Size

On 18 April 2026, attackers compromised KelpDAOs LayerZero powered rsETH bridge, minting about 116,500 rsETH without backing and depositing it into Aave V3 on Ethereum and Arbitrum as collateral.

They then borrowed large amounts of WETH and wstETH, leaving Aave with bad debt estimated between roughly 196 and 230 million dollars when the unbacked rsETH was recognized and markets were frozen. Importantly, reporting agrees that Aaves core smart contracts were not directly hacked; the weakness was accepting rsETH from a compromised bridge as high quality collateral.

This shock triggered a bank run style response, with Aaves total value locked dropping by tens of billions of dollars as lenders withdrew or rotated to alternatives like Spark and Morpho.

2. DeFi United Recapitalization Effort

In response, Aave service providers and partner protocols launched a relief campaign branded DeFi United, focused on recapitalizing the rsETH shortfall and restoring Aaves balance sheet. CoinDesk reports that this effort has raised about 160 million dollars, nearly 80 percent of the roughly 200 million dollar hole.

According to detailed breakdowns, Mantle and Aave DAO together pledged 55,000 ETH (about 127 million dollars), with Mantle offering a 30,000 ETH three year credit facility and Aave DAO proposing 25,000 ETH pending governance approval, alongside contributions from Aave founder Stani Kulechov, Ether.fi, Lido DAO, Golem and others. A Bitcoin.com overview of DeFi Uniteds fund also notes this multi party structure.

Separately, the Arbitrum Security Council has frozen over 30,000 ETH linked to the attacker, which may eventually be returned through governance, further reducing the net loss that must be socialized.

3. Remaining Risks And Key Watchpoints

Despite the fundraising, several markets remain stressed. Some WETH and rsETH reserves are still frozen on affected networks, and utilization in key pools recently hit extreme levels, limiting withdrawals and liquidations during the peak panic.

Aave governance and community forums are actively debating who ultimately bears residual losses, including questions about isolating L2 bad debt, the role of the Umbrella risk module, and how far to rely on KelpDAOs own reserves versus Aaves treasury or stakers. Final incident reports and formal proposals will determine how fairly risk is allocated across rsETH holders, L2 users, mainnet lenders and AAVE stakeholders.

For Aave users and AAVE holders, the main signals to monitor are: progress on DeFi United fundraising, governance votes on Aave DAOs ETH contribution and debt allocation, the timeline for unfreezing markets, and whether Aaves TVL and on chain liquidity start to recover.

Conclusion

Aave has turned a potentially existential bad debt event into a contained, though still serious, recapitalization problem by rallying a large industry wide backstop and recovering some attacker funds.

The core question now is not whether the protocol survives, but how the remaining losses are distributed and whether governance choices rebuild trust enough for liquidity to return.