TLDR
- An attacker exploited KelpDAO’s LayerZero bridge to create 116,500 worthless rsETH tokens, draining approximately $292 million
- Using fraudulent collateral, the hacker extracted roughly $190M in ETH from Aave, creating a deficit exceeding 112,000 rsETH
- Aave experienced approximately $9 billion in net withdrawals; DeFi’s total value locked plummeted by roughly $13 billion in two days
- Industry leaders formed “DeFi United” as a rescue initiative, with contributions pledged by Lido, EtherFi, and Aave’s creator
- Significant portions of stolen assets were converted to Bitcoin through Thorchain, severely limiting recovery prospects
On April 18, 2026, a cybercriminal discovered and exploited a critical flaw in the LayerZero bridge integration used by KelpDAO, creating 116,500 rsETH tokens without any underlying assets to support them.
Instead of liquidating these fabricated tokens right away, the perpetrator strategically deposited approximately 90,000 of them into Aave as loan collateral. Using this worthless backing, they successfully withdrew about $190 million in ETH and other digital assets across both Ethereum and Arbitrum networks.
This maneuver left Aave trapped with collateral that had zero actual value. Alert users rapidly identified the problem and initiated widespread fund withdrawals, creating a panic resembling a traditional banking run.
Aave’s total value locked plummeted by approximately $10 billion in the hours following the attack. By April 21, net withdrawals had reached roughly $9 billion, with TVL collapsing from more than $17.5 billion down to approximately $14.3 billion.
The crisis extended well beyond Aave’s platform. Throughout the entire decentralized lending ecosystem, total value locked contracted by approximately $13 billion in the 48-hour period after the exploit became widely known.
Arbitrum’s security council responded swiftly, successfully freezing 30,766 ETH — valued at roughly $71 million — connected to the malicious activity. Unfortunately, substantial portions of the stolen capital were converted into Bitcoin via Thorchain, dramatically complicating any potential recovery efforts.
The DeFi United Recovery Effort
Aave along with its service partners initiated a coordinated emergency response branded “DeFi United,” designed to recapitalize rsETH reserves and contain the spread of toxic debt throughout lending protocols.
Lido Finance emerged as the first major contributor to formally commit resources. Through its Lido Labs Foundation, the organization proposed deploying up to 2,500 stETH, representing approximately $5.7–$6 million, into a specialized relief fund. These resources would be released only if the total recovery package proves sufficient to address the complete deficit.
EtherFi announced its intention to contribute 5,000 ETH toward protecting ecosystem participants and preventing further debt accumulation. Aave founder Stani Kulechov personally committed an additional 5,000 ETH.
“Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” Kulechov posted on X.
Lido’s participation isn’t purely altruistic. The organization operates an EarnETH vault with direct rsETH exposure, meaning without an effective solution, vault participants could face losses approaching 9,000 ETH.
rsETH Reserves Paused Across Multiple Chains
Aave took immediate defensive action by suspending rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle, and Linea networks while recovery strategies were being developed.
The total deficit is calculated at more than 112,000 rsETH, based on Aave’s official incident analysis. The DeFi United initiative concentrates not on retrieving stolen assets but rather on stabilizing the ecosystem through new capital injections.
Aave indicated that additional commitments are anticipated once they receive formal confirmation.
