Key Takeaways
- An attacker exploited KelpDAO’s LayerZero bridge integration to create 116,500 unbacked rsETH tokens worth approximately $292 million
- Using fraudulent collateral, the hacker drained roughly $190M in ETH from Aave across multiple networks
- Panic-driven withdrawals resulted in nearly $9 billion leaving Aave; DeFi’s total value locked plummeted by ~$13 billion in two days
- Industry leaders including Lido, EtherFi, and Aave’s founder launched “DeFi United” with pledged ETH to stabilize the protocol
- Significant portions of stolen assets were converted to Bitcoin through Thorchain, complicating recovery prospects
On April 18, 2026, an exploiter targeted a critical weakness in KelpDAO’s bridge connection with LayerZero, successfully generating 116,500 rsETH tokens without any underlying collateral to support them.
Instead of immediately liquidating these fabricated tokens, the perpetrator strategically deposited approximately 90,000 rsETH into Aave as legitimate collateral. Using this fraudulent backing, they proceeded to withdraw around $190 million in ETH and additional digital assets from both Ethereum mainnet and Arbitrum.
The result was devastating: Aave suddenly held collateral with zero intrinsic value. Alert community members detected the anomaly rapidly, sparking a cascade of withdrawals that resembled a traditional bank run.
Aave’s total value locked plummeted by approximately $10 billion in the immediate hours following the breach. By April 21, net capital flight reached roughly $9 billion, with TVL collapsing from over $17.5 billion to approximately $14.3 billion.
The contagion extended far beyond Aave alone. Throughout the decentralized lending ecosystem, total value locked contracted by approximately $13 billion within a 48-hour window after news of the exploit broke publicly.
Arbitrum’s security council responded swiftly, successfully freezing 30,766 ETH—valued at roughly $71 million—connected to the malicious activity. Unfortunately, the majority of compromised funds had already been routed into Bitcoin via Thorchain, substantially diminishing prospects for complete recovery.
Industry Mobilizes Behind DeFi United Initiative
Aave alongside its ecosystem partners initiated a unified response dubbed “DeFi United,” designed to recapitalize the rsETH shortfall and prevent cascading bad debt throughout lending platforms.
Lido Finance emerged as the first major contributor to formalize support. The Lido Labs Foundation put forward a proposal to allocate up to 2,500 stETH—approximately $5.7–$6 million—into a designated recovery fund. These resources would only be released if the total package proves sufficient to address the complete deficit.
EtherFi subsequently announced its commitment to contribute 5,000 ETH toward protecting affected users and halting debt accumulation. Aave founder Stani Kulechov personally committed an additional 5,000 ETH to the effort.
“Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” Kulechov posted on X.
Lido’s participation carries strategic importance beyond altruism. The organization operates an EarnETH vault with direct rsETH exposure, and absent a comprehensive solution, vault participants could face losses approaching 9,000 ETH.
Emergency Measures Freeze rsETH Operations
Aave implemented emergency protocols by suspending rsETH reserves throughout Ethereum Core, Arbitrum, Base, Mantle, and Linea networks pending resolution of the recovery strategy.
The complete shortfall exceeds 112,000 rsETH based on Aave’s official incident assessment. DeFi United’s primary objective centers not on retrieving stolen assets but rather on system stabilization through new capital injections.
Aave indicated that additional commitments from ecosystem participants are anticipated once they receive formal confirmation.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
