TLDR
- A hacker minted 116,500 unbacked rsETH tokens via a KelpDAO-LayerZero bridge exploit, stealing ~$292 million
- The attacker borrowed ~$190M in ETH from Aave using fake collateral, leaving a hole of over 112,000 rsETH
- Aave lost ~$9 billion in net outflows; total DeFi TVL dropped ~$13 billion within 48 hours
- A recovery effort called “DeFi United” was launched, with Lido, EtherFi, and Aave’s founder all pledging ETH
- Stolen funds were partly bridged to Bitcoin via Thorchain, making full recovery unlikely
A hacker exploited a vulnerability in KelpDAO’s LayerZero bridge integration on April 18, 2026, minting 116,500 rsETH tokens that had no real backing behind them.
KelpDAO (@KelpDAO) Hack Update:
The hacker has finished converting all the stolen 75,701 $ETH (~$175M) into $BTC, using THORChain and other swap routes on Ethereum.
Meanwhile, the crypto community is stepping up to help cover the losses:
🔹 Mantle (@Mantle_Official) has… https://t.co/YGNJdWlCl0 pic.twitter.com/I0hJOTqB4B— Crypto Patel (@CryptoPatel) April 24, 2026
Rather than selling the tokens immediately, the attacker deposited around 90,000 of them into Aave as collateral. They then borrowed approximately $190 million worth of ETH and other assets across Ethereum and Arbitrum.
This left Aave holding collateral that was essentially worthless. Users noticed quickly and began pulling funds, triggering a bank-run style withdrawal wave on the platform.
Aave’s total value locked dropped by around $10 billion in the immediate aftermath. Net outflows reached roughly $9 billion by April 21, and TVL fell from over $17.5 billion to around $14.3 billion.
The damage spread beyond Aave. Across all decentralized lending protocols, total value locked fell by roughly $13 billion within 48 hours of the exploit becoming public.
Arbitrum’s security council acted early, freezing 30,766 ETH — worth around $71 million — tied to the attack. However, much of the remaining stolen funds were moved into Bitcoin through Thorchain, making recovery significantly harder.
The DeFi United Recovery Effort
Aave and its service providers launched a coordinated response called “DeFi United,” focused on recapitalizing rsETH and preventing bad debt from spreading further across lending markets.
Lido Finance was first to formally step up. Its Lido Labs Foundation proposed allocating up to 2,500 stETH, worth approximately $5.7–$6 million, into a dedicated relief vehicle. The funds would only be deployed if the recovery package is large enough to cover the entire shortfall.
EtherFi followed with a proposal to contribute 5,000 ETH to protect users and stop bad debt from accumulating. Aave founder Stani Kulechov also pledged 5,000 ETH personally.
“Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” Kulechov posted on X.
Lido’s involvement is partly self-interested. The company runs an EarnETH vault with direct exposure to rsETH, and without a coordinated fix, losses for vault users could reach around 9,000 ETH.
rsETH Reserves Paused Across Multiple Chains
Aave moved to limit further damage by pausing rsETH reserves across Ethereum Core, Arbitrum, Base, Mantle, and Linea while recovery planning continued.
The total shortfall is estimated at more than 112,000 rsETH, according to Aave’s own incident report. The focus of DeFi United is not on recovering stolen funds but on stabilizing the system through fresh capital commitments.
Aave said more commitments are expected to be announced once formally confirmed.
