Seven DeFi protocols and seven individual contributors have committed 100,390 ETH ($232M) to restore the backing of rsETH after the April 18 KelpDAO bridge exploit drained 116,500 rsETH ($292M) from the protocol's LayerZero adapter. The coordinated effort, branded "DeFi United," represents the la...
"Aave is my life's work and we're working nonstop to find the best possible outcome for users." — Stani Kulechov, Founder, Aave
Seven DeFi protocols and seven individual contributors have committed 100,390 ETH ($232M) to restore the backing of rsETH after the April 18 KelpDAO bridge exploit drained 116,500 rsETH ($292M) from the protocol's LayerZero adapter. The coordinated effort, branded "DeFi United," represents the largest cross-protocol bailout in decentralized finance history.
The initiative reveals a structural reality that DeFi participants have been reluctant to name: major lending protocols, liquid staking providers, and L2 networks are so deeply interconnected through shared collateral dependencies that a failure in one asset can cascade through the entire system. Aave lost $6.6B in TVL within 48 hours. The broader DeFi sector shed $13B. The seven protocols that stepped in did so not out of altruism but because their own balance sheets were at risk.
This report examines the contribution structure, incentive alignment, and governance mechanics of DeFi United. It compares how each participant's exposure dictated their contribution size, analyzes the terms of Mantle's 30,000 ETH credit facility, and assesses whether this ad-hoc coordination model constitutes an implicit backstop — and at what cost.
At 17:35 UTC on April 18, 2026, attackers exploited KelpDAO's LayerZero bridge adapter to mint 116,500 unbacked rsETH tokens, valued at approximately $292M at the time of the attack. According to Chainalysis, the attackers — linked to North Korea's Lazarus Group — compromised two of LayerZero's verification servers and executed a distributed denial-of-service attack against backup servers, forcing the system to rely on compromised nodes.
The bridge operated on what security researchers described as a "1-of-1 DVN setup" — a single decentralized verifier network node that, once compromised, provided no fallback. The attacker exploited this single point of failure to trick the bridge into accepting a fraudulent cross-chain instruction, minting rsETH with no underlying collateral.
KelpDAO's incident response team paused contracts within hours, blocking a second attempted drain of approximately $95M. The drained rsETH represented approximately 18% of all circulating supply.
The attacker deposited 89,567 of the unbacked rsETH into Aave as collateral, then borrowed approximately $190M in ETH, USDC, USDT, and other tokens across Ethereum and Arbitrum deployments. This left Aave holding impaired collateral — rsETH tokens that no longer had full backing.
According to Aave's own incident report published April 20, the protocol faced two loss scenarios:
| Scenario | Bad Debt Estimate | Condition | |----------|------------------|-----------| | Loss distributed across all rsETH holders | ~$124M | 15% rsETH depeg | | Loss isolated to L2 networks | ~$230M | Concentrated on Arbitrum, Mantle |
Aave's Umbrella insurance module held $55.1M in WETH staking reserves at the time — covering less than a quarter of the worst-case exposure. Within 48 hours, depositors withdrew $6.6B from Aave, reducing total deposits from $48.5B to approximately $41.9B. The broader DeFi sector lost $13B in TVL over the same period, falling from $99.5B to approximately $86.5B, according to CoinDesk.
The protocol froze rsETH markets across all deployments — Ethereum Core, Arbitrum, Base, Mantle, and Linea — set loan-to-value ratios to zero, and halted all new borrowing against the asset.
On April 23, Aave service providers launched DeFi United with a target of raising 100,000 ETH. As of April 25, 14 contributors had committed 69,642 ETH ($161M). The contribution structure reveals a hierarchy shaped by exposure, not generosity.
| Contributor | Amount (ETH) | Type | Status | |------------|-------------|------|--------| | Mantle | 30,000 | Credit facility (loan) | Terms under negotiation | | Aave DAO | 25,000 | Treasury allocation | Governance vote pending | | Stani Kulechov (Aave founder) | 5,000 | Personal pledge | Committed | | EtherFi | 5,000 | Protocol contribution | Committed | | Lido DAO | 2,500 | stETH contribution | Aragon vote pending | | Golem Foundation | 1,000 | Donation | Committed | | Emilio Frangella (Aave VP Eng.) | 500 | Personal pledge | Committed | | BGD Labs | 250 | Contribution | Committed | | Community donations | 340 | Various | Received | | Ethena | Undisclosed | Contribution | Committed | | Ink Foundation | Undisclosed | Contribution | Committed | | Total | ~69,642 | | |
The top three contributors — Mantle, Aave DAO, and Stani Kulechov — account for 86% of committed funds. Mantle's 30,000 ETH alone represents 43% of the total, but it is structured as a loan, not a donation.
Mantle's contribution merits separate examination. The 30,000 ETH facility is structured as a three-year loan at Lido's staking APR plus 1%, with Aave delegating 130,000 AAVE governance tokens as collateral.
This structure accomplishes three objectives simultaneously:
The loan terms convert what appears to be a bailout contribution into a structured financial product. Mantle takes on limited risk — the AAVE token collateral provides downside protection — while gaining governance influence over DeFi's largest lending protocol.
On April 20, at 11:26 PM ET, Arbitrum's 12-member Security Council executed an emergency action to freeze 30,766 ETH ($71M) linked to the exploit. The funds were transferred to an ownerless wallet, rendering them immobile pending a full DAO governance vote.
Steven Goldfeder, Offchain Labs co-founder, stated: "The default was do nothing." He added that the Security Council acted on law enforcement input regarding the attacker's identity and noted: "The DAO cannot be consulted, because the second the DAO is consulted, that essentially means North Korea is consulted."
The freeze recovered roughly one-quarter of the total stolen funds but exposed a tension at the core of L2 architecture. A 12-member elected council unilaterally overrode transaction finality on a network processing billions in daily volume. Patrick McCorry, Arbitrum Foundation head of research, characterized the council as "a very transparent part of the system" with members "elected by token holders… not hand-picked by us."
The remaining stolen funds were bridged to Bitcoin via THORChain within hours of the Arbitrum intervention, complicating further recovery.
The total rsETH shortfall has been estimated at approximately 116,500 ETH — the amount of unbacked tokens minted during the exploit. Multiple recovery streams are working to close this gap:
| Recovery Source | Amount (ETH) | Status | |----------------|-------------|--------| | Arbitrum Security Council freeze | 30,766 | Frozen, DAO vote pending | | DeFi United pledges | 69,642 | Partially committed, partially pending governance | | KelpDAO direct recovery | ~16,000 | Recovered via contract pause | | Total identified | ~116,408 | | | Remaining gap | ~92 | Nominal, contingent on all pledges converting |
On paper, the gap is nearly closed. In practice, the math depends on three governance votes passing (Aave DAO, Lido DAO, and Arbitrum DAO) and Mantle's credit facility terms being finalized. If any major commitment fails to materialize, the shortfall reopens.
Aave's 25,000 ETH proposal is currently in the community feedback stage before proceeding to a Snapshot vote. Lido's 2,500 stETH contribution is conditioned on "the full funding gap being closed" — a circular dependency that could stall if other contributors pull back.
The contributor list maps almost perfectly to the protocols with the largest rsETH exposure. This is not a coincidence.
Aave held 89,567 rsETH as collateral in its lending markets. An unresolved depeg would generate up to $230M in bad debt — more than four times its insurance reserves. Contributing 25,000 ETH ($58M) to prevent $230M in losses is a straightforward economic calculation.
Lido issued the underlying stETH that backs a significant portion of rsETH's reserves. A collapse in rsETH would raise contagion questions about liquid staking token integrity broadly, potentially triggering withdrawals from Lido's own $15B+ staking pool.
EtherFi operates the eETH liquid restaking token that competes directly with rsETH. A market-wide loss of confidence in restaking derivatives would damage EtherFi's core product, regardless of whether eETH itself was exploited.
Ethena had $412M in USDe exposure routed through Aave. Bad debt at Aave could trigger USDe redemption pressure, threatening Ethena's dollar peg.
Mantle runs rsETH lending markets on its own L2. A permanently impaired rsETH would leave bad debt on Mantle's chain and undermine confidence in its ecosystem.
Each participant's contribution correlates with their potential loss if the bailout fails. This is not philanthropy. It is self-interested coordination — a rational response to shared systemic exposure.
As of April 26, three critical governance decisions remain unresolved:
Aave DAO: The 25,000 ETH treasury allocation is in community feedback. A Snapshot vote has not yet been scheduled. If the vote fails, $58M in committed funding disappears.
Lido DAO: The 2,500 stETH contribution requires an on-chain Aragon vote. Lido has attached a condition: the contribution only proceeds if the full funding gap is closed by other participants. This creates a coordination chicken-and-egg problem.
Arbitrum DAO: The 30,766 ETH freeze must be ratified by a full DAO governance vote. The Security Council acted under emergency powers; the DAO must decide whether to return, burn, or redirect the frozen funds.
If all three votes pass, the rsETH shortfall is functionally covered. If any fails, the recovery framework unravels and the remaining contributors face pressure to increase their commitments or accept partial losses.
DeFi United has committed 69,642 ETH ($161M) from 14 contributors toward a 100,000 ETH target to restore rsETH backing after the $292M KelpDAO bridge exploit.
The bailout is self-interested, not altruistic. Each major contributor faces direct balance-sheet exposure to an rsETH collapse. Aave alone faced up to $230M in bad debt.
Mantle's 30,000 ETH "contribution" is a structured loan earning 4.5% annually with 130,000 AAVE governance tokens as collateral — a financial product, not aid.
Arbitrum's $71M freeze recovered 26% of stolen funds but required a 12-member council to override transaction finality, exposing the centralization tradeoffs embedded in L2 security models.
Three governance votes remain pending. Aave's 25,000 ETH, Lido's 2,500 stETH, and Arbitrum's frozen fund disposition must all pass for the funding gap to close. Lido's contribution is explicitly conditional on full gap closure.
Aave lost $6.6B in TVL within 48 hours of the exploit, while broader DeFi TVL fell $13B. The withdrawal wave stopped only after DeFi United launched.
The 1-of-1 DVN bridge design that enabled the exploit represents a systemic vulnerability in cross-chain infrastructure. Single-verifier bridge architectures remain a recurring attack surface.
DeFi United is not a bailout fund. It is a mutual defense pact among protocols whose balance sheets are intertwined through shared collateral. The $161M committed so far reflects rational self-preservation: each contributor calculated that the cost of participation was lower than the cost of inaction.
The episode exposes a structural feature of DeFi that its participants rarely acknowledge publicly. Major protocols are not independent systems. They are nodes in a collateral dependency graph where a failure in one asset — rsETH, in this case — propagates through lending markets, liquid staking pools, L2 ecosystems, and synthetic dollar protocols simultaneously. Aave's $6.6B TVL drop was not a bank run on Aave. It was a system-wide repricing of interconnection risk.
Whether the gap closes depends on governance. Three token holder votes must pass. Mantle's loan terms must be finalized. Lido's conditional commitment must unlock. The funding arithmetic works on paper. Whether it works in practice remains an open question, and every day the gap stays open, the cost of resolution increases.