Aave's 'DeFi United' Bailout: Overcoming $17B Bank Run After $292M KelpDAO Hack
The Largest Voluntary DeFi Rescue in History
On Saturday, April 18, 2026, decentralized finance experienced one of its most consequential single-day shocks. KelpDAO, a liquid restaking protocol built on top of EigenLayer, lost 116,500 rsETH—worth roughly $292 million at the time—through a sophisticated exploit of its LayerZero-based cross-chain bridge. One week later, on April 25, market attention has shifted away from the hack itself toward something arguably more historic: the largest voluntary, protocol-led bailout DeFi has ever attempted, branded "DeFi United" and led by Aave founder Stani Kulechov. According to CoinDesk and crypto.news, pledges have already surpassed 43,500 ETH, or more than $101 million, with the participant list still expanding.
The stakes could hardly be higher. Aave's total value locked plunged by approximately $8.45 billion in the 48 hours following the exploit, settling near $17.95 billion, while DeFi-wide TVL collapsed from $99.5 billion to $86.3 billion—a $13.2 billion wipeout. The AAVE governance token plummeted roughly 20% from around $115 to below $92 in a matter of hours. This was not just a hack. It was a stress test of DeFi's ability to police itself.
Anatomy of the Exploit: A Single-Verifier Catastrophe
Research published by Galaxy and OpenZeppelin has clarified that this was not a smart contract bug in the traditional sense. KelpDAO bridged rsETH across roughly 20 chains using LayerZero's Omnichain Fungible Token (OFT) standard, but its bridge was configured with only one Designated Verifier Network (DVN): the LayerZero Labs DVN itself. There was no second independent verifier required to confirm cross-chain messages. If that single verifier could be tricked, no one else would catch it.
The attackers, whom LayerZero has publicly attributed to North Korea's Lazarus Group, compromised two RPC nodes that the LayerZero Labs DVN relied on to read source-chain state. By feeding the verifier falsified data, they convinced it that legitimate burns had occurred on Ethereum mainnet, allowing the bridge to mint 116,500 rsETH on destination chains with no underlying ETH backing. KelpDAO has disputed LayerZero's framing of the incident, arguing that the single-verifier setup relied on LayerZero's own defaults rather than a configuration KelpDAO chose against advice. That blame battle has profound implications for cross-chain security accountability going forward.
The $17 Billion Bank Run: How rsETH Toppled Aave
The attackers' true objective went well beyond simple theft. The exploit team immediately deposited approximately 90,000 of the freshly minted, unbacked rsETH into Aave V3 as collateral, using the inflated balance to borrow somewhere between $190 million and $236 million in WETH, wstETH, and stablecoins on Ethereum and Arbitrum. According to The Defiant and KuCoin Research, this maneuver left Aave with roughly $196 million in concentrated bad debt in the rsETH-wETH lending pair on Ethereum—debt that could not realistically be liquidated because the underlying collateral had no genuine ETH backing and would never trade near peg again.
What followed was a textbook on-chain bank run. Within 24 hours, whale wallets pulled more than $6 billion from Aave. Utilization rates on the protocol's largest pools—ETH, USDT, and USDC—spiked to 100%, sending borrow rates briefly into triple digits. CoinDesk reported a $300 million surge in active borrowing demand in a single day as users scrambled to extract liquidity before others could. AAVE token holders panicked alongside depositors. Multiple whale addresses, including one labeled "smaugvision," collectively dumped nearly 60,000 AAVE within hours, with that single wallet selling 20,015 AAVE for roughly $2.06 million at around $103 per token. CoinMarketCap data shows the resulting 20% crash was overwhelmingly idiosyncratic to Aave rather than reflective of broader market stress.
DeFi United: A New Template for Crypto Crisis Response
What happened next has no real precedent. Beginning April 19, Aave service providers began coordinating a multi-protocol relief effort that, by April 23, had taken formal shape as the [ARFC] rsETH Incident Funding Update on Aave's governance forum. The initiative, dubbed "DeFi United," is explicitly designed not to bail out the attacker's victims but to restore the underlying ETH backing of rsETH so that legitimate holders—and Aave's own collateral pool—can be made whole.
The pledges, as documented by Decrypt and crypto.news, are striking in both their scale and their voluntary nature. Stani Kulechov personally committed 5,000 ETH (approximately $11.5 million) from his own holdings, stating: "Aave is my life's work and we're working nonstop to find the best possible outcome for users. I'm personally contributing 5,000 ETH." Mantle's core team published proposal MIP-34, offering Aave DAO a credit facility of up to 30,000 ETH structured as a loan at Lido's stETH yield rate plus 100 basis points, repayable over up to 36 months. Ether.fi pledged 5,000 ETH, Lido DAO submitted a proposal for up to 2,500 stETH, and Golem Foundation together with Golem Factory committed a combined 1,000 ETH. Frax Finance, Ethena, Tydro, the Arbitrum Foundation, the Ink Foundation, and—notably—LayerZero itself rounded out the initial coalition.
Combined with the 73,700 ETH that KelpDAO has independently recovered through on-chain forensics and exchange freezes, the path back to full rsETH backing is now visible, even if approximately 89,500 ETH still needs to be sourced.
Market Impact: V-Shaped Recovery in AAVE, Structural Repricing in LRTs
The market response shifted sharply once the contours of DeFi United became clear. AAVE bottomed near $92 on April 19 and has since recovered to $94.33 as of April 24, according to Decrypt's price feed, on volumes more than four times the 30-day average. Invezz characterized the move as "a textbook V-shaped recovery driven by execution speed," noting that Aave's risk team paused rsETH reserves on Ethereum, Arbitrum, Base, Mantle, and Linea within hours of the exploit, preventing further collateral abuse.
The broader liquid restaking token (LRT) sector has not been so lucky. Yahoo Finance reports that of the roughly $15 billion that fled Aave, much migrated to Sky (formerly Maker), Morpho, and simple stETH staking pools—suggesting users are voluntarily de-leveraging the "yield-on-yield" stack. Pressure is mounting for lending protocols to reduce loan-to-value ratios on EtherFi's weETH, Renzo's ezETH, and Puffer's pufETH. The implicit assumption that LRTs are merely stETH with extra yield has been shattered: every LRT carries an additional bridge-and-restaking trust layer that, as KelpDAO demonstrated, can fail catastrophically and independently of Ethereum's own security.
Outlook: A Test Case for Decentralized Governance
The deepest question DeFi United raises is jurisdictional: in a system without a central bank or deposit insurance, who bears the cost of systemic failure? Traditional finance answers with lender-of-last-resort facilities and FDIC backstops. DeFi's answer, at least for now, appears to be reputation-weighted voluntary mutualization—major protocols stepping up because their long-term legitimacy depends on the lending layer surviving.
Galaxy Research argues that the precedent set this week will likely make multi-DVN configurations a non-negotiable standard for any cross-chain bridge handling significant value, and that LRT collateral on lending protocols will see materially tighter risk parameters. Mantle's MIP-34 structure—a 36-month, interest-bearing inter-DAO credit facility—is particularly notable because it could become the template for future DeFi crisis responses, replacing ad-hoc emergency votes with a more institutional debt-restructuring playbook.
For investors, three takeaways are paramount. First, LRTs embed a "compound trust assumption" that pure staking derivatives like stETH do not, and they should be priced and risk-managed accordingly. Second, near-term AAVE volatility will hinge on the speed at which bad debt is absorbed and on the outcome of the various DAO governance votes funding the relief effort—markets will reward execution and punish delay. Third, if DeFi United succeeds in fully restoring rsETH backing without resorting to socialized losses for ordinary depositors, it will provide one of the strongest pieces of evidence yet that decentralized finance can self-correct from systemic crises without external intervention.
Conclusion
The $292 million KelpDAO hack is, by raw dollar amount, the largest crypto exploit of 2026. But its lasting significance will be measured not by the size of the loss but by the response it provoked. Aave's leadership in assembling a coalition of more than a dozen protocols, pledging over $101 million in ETH within days, demonstrates a maturation of DeFi governance that few thought possible just a year ago. As of April 25, AAVE is recovering, TVL is stabilizing, and the funding gap is narrowing. The remaining 89,500 ETH shortfall, the redesign of LRT collateral models, and the unresolved blame battle between LayerZero and KelpDAO will determine the trajectory of decentralized lending for months to come. What is already clear is that this episode marks an inflection point—the moment DeFi stopped being a frontier experiment and started behaving like a self-regulating financial system, scars and all.