The decentralized finance (DeFi) landscape is reeling after a substantial hack that has sent ripples through the community. On April 18, 2026, a hacker executed a bold exploit on KelpDAO’s LayerZero bridge integration, minting an astonishing 116,500 rsETH tokens that were devoid of real backing. The breach has resulted in losses totaling approximately $292 million, marking it as one of the most significant crypto hacks of the year.
In a calculated move, the attacker proceeded to borrow roughly $190 million in Ethereum (ETH) from Aave by using the unbacked rsETH tokens as fake collateral, leaving a troubling deficit of over 112,000 rsETH in its wake. This exploit was not just a blow for Aave; it has had far-reaching effects throughout the DeFi space, with total value locked (TVL) across decentralized lending platforms plummeting by about $13 billion within just 48 hours.
In the immediate fallout of the exploit, Aave observed net outflows reaching around $9 billion as users rushed to withdraw their funds amid growing concerns of security. The platform saw its total value locked decline dramatically from over $17.5 billion to around $14.3 billion.
Aave’s crisis management team took swift action as the situation unfolded. The security council of Arbitrum intervened promptly by freezing 30,766 ETH, estimated to be worth around $71 million, that was linked to the attack. However, the hacker’s subsequent actions, including transferring a significant amount of stolen funds into Bitcoin via Thorchain, have complicated the recovery efforts.
The DeFi United Recovery Initiative
In response to this unprecedented event, a coalition called “DeFi United” has emerged, aiming to stabilize the ecosystem and prevent the fallout from spreading further. Aave, alongside major players like Lido and EtherFi, is committed to recapitalizing the affected tokens and safeguarding their users.
Lido Finance has taken the lead, proposing to allocate up to 2,500 stETH, equivalent to approximately $5.7 to $6 million, into a tailored relief vehicle. This initiative is contingent upon ensuring that the total recovery effort suffices to address the shortfall. EtherFi has also stepped in, pledging 5,000 ETH to assist in mitigating user losses, while Aave’s founder, Stani Kulechov, has promised to contribute 5,000 ETH personally, emphasizing his dedication to the platform.
“Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” Kulechov shared on social media.
Lido’s involvement highlights a mutual interest, as the firm operates an EarnETH vault directly exposed to rsETH, and without a cohesive recovery plan, losses for vault participants could escalate to around 9,000 ETH.
Pausing Reserves and Future Prospects
To combat further infrastructural damage, Aave has taken precautionary steps by pausing rsETH reserves on multiple chains, including Ethereum Core, Arbitrum, Base, Mantle, and Linea, as the recovery strategy unfolds. Aave’s incident report estimates the total shortfall at over 112,000 rsETH, reinforcing the urgency of the situation.
The primary focus of DeFi United is on reinforcing the system through fresh capital commitments rather than merely recovering stolen assets, a reflection of the community’s resilience amidst unprecedented challenges. Additional commitments are expected to emerge as discussions continue, signaling a cohesive front in the face of adversity.
