TLDR
Major DeFi protocols have formed a "DeFi United" coalition pledging over $300 million to repair damage from the Kelp maker/">DAO rsETH exploit and stabilize Aave and related markets.
- The Kelp DAO rsETH bridge hack drained about $292 million and left Aave with over $100 million in bad debt, triggering a severe liquidity crunch.
- Aave, Consensys, Lido, EtherFi, Mantle and others have pledged around 132,650 ETH (about $303 million) in donations, loans and credit lines to recapitalize rsETH and Aave.
- The plan still depends on multiple governance votes and technical execution, so users should watch approval timelines, liquidation steps and any new security measures on bridges and oracles.
Deep Dive
1. What Happened In The Exploit
On 18 April, attackers forged a message on Kelp DAO's LayerZero-powered rsETH bridge, minting about 116,500 unbacked rsETH worth roughly $292 million and using it as collateral across Aave and Compound, creating large bad debt and locked liquidity for users on Aave's WETH and stablecoin markets. The incident is widely attributed to North Korea linked Lazarus Group and is described as one of DeFi's largest exploits of 2026, leaving rsETH underbacked and Aave facing an estimated 123.7 million to 230.1 million dollars in shortfall. Aave paused rsETH markets on Ethereum and several L2s while Arbitrum's security council froze around 30,765 ETH tied to the attacker to limit further damage.
2. How The 300M Recovery Coalition Works
In response, Aave service providers launched "DeFi United", a cross protocol recovery initiative focused on restoring rsETH's backing and absorbing bad debt. DeFi United has raised about 132,650 ETH, valued near 303 million dollars, from a mix of grants, loans and credit facilities contributed by participants including Consensys and Joseph Lubin, who pledged up to 30,000 ETH, Mantle with a proposed 30,000 ETH credit line, Lido with up to 2,500 stETH, Golem entities and Aave founder Stani Kulechov with 5,000 ETH. The coalition plans to convert committed ETH into rsETH in tranches and send it to a lockbox contract, while also orchestrating controlled liquidations of exploiter positions on Aave and Compound to recover additional ETH.
If fully executed, the package is large enough to plug the rsETH hole and materially reduce systemic risk across major lending protocols, which is unusual positive coordination for DeFi.
3. What Could Still Go Wrong
Most of the pledged support is contingent on protocol governance approvals, legal agreements and complex execution sequences, including Arbitrum votes to release frozen ETH and multiple DAO decisions across contributors. The technical plan involves temporarily adjusting rsETH oracle pricing to unwind eight large positions and could be disrupted if the attacker front runs or interferes with liquidations. Until tranches are executed and markets are unfrozen, Aave and rsETH users remain exposed to timing risk, and new bridge and oracle safeguards from Kelp DAO, LayerZero and others will need real world validation.
Recovery looks funded on paper, but the real risk is execution and governance delay, so users should watch DAO votes, implementation updates and any signs of renewed liquidity stress.
Conclusion
A $292 million bridge exploit pushed Aave and rsETH into a severe liquidity and collateral crisis, but a broad DeFi coalition has now pledged more than enough capital to make the system whole in principle. The episode highlights both the systemic risk of cross chain infrastructure and the growing willingness of major protocols to mutualize recovery when a failure threatens shared users. Whether this becomes a long term confidence boost for DeFi will depend on how smoothly governance, liquidations and new security measures are implemented in the coming weeks.
CoinsKid.Com