The fallout from the largest crypto exploit of 2026 has triggered something the decentralized finance industry rarely sees: a coordinated bailout effort spanning multiple competing protocols. Aave, the sector’s dominant lending platform, is leading what it calls “DeFi United,” a collective initiative designed to plug a massive collateral gap left by the $292 million KelpDAO bridge hack.
How DeFi United Came Together
Aave service providers organized the initiative after the exploit left the platform carrying a significant amount of impaired collateral. According to Aave’s incident report, approximately 112,000 rsETH tokens – a yield-bearing derivative of ether – remain unbacked after an attacker exploited a vulnerability in KelpDAO’s LayerZero bridge integration.
The attacker minted 116,500 fraudulent rsETH tokens by manipulating the bridge’s messaging system, then deposited roughly 90,000 of those tokens into Aave as collateral. From there, roughly $190 million in ETH and other assets were borrowed across Ethereum and Arbitrum before anyone caught on.
Aave announced on X that commitments were already materializing from across the system.
Who Is Stepping Up
Lido Finance moved first. The Lido Labs Foundation filed a governance proposal to allocate up to 2,500 stETH – approximately $5.7 million at current prices – into a dedicated relief vehicle. The capital would help close the rsETH backing shortfall and prevent forced liquidations across lending markets.
EtherFi followed with a proposal committing 5,000 ETH to “protect users and prevent bad debt” across the DeFi field.
Aave founder Stani Kulechov went a step further, pledging a personal contribution of 5,000 ETH from his own holdings. “Aave is my life’s work and we’re working nonstop to find the best possible outcome for users,” Kulechov wrote in a post on X. “I’m working to see this resolved and market conditions normalized as soon as possible.”
Aave said additional commitments would be announced as they’re formalized.
The Damage So Far
The scale of disruption has been severe. Total value locked across Aave dropped by approximately $10 billion following the exploit, as depositors rushed to withdraw available funds in a classic DeFi bank run scenario.
Earlier containment efforts provided partial relief. Arbitrum’s security council froze 30,766 ETH – worth roughly $71 million at the time – that were tied to the stolen funds and remained on the Layer 2 network.
But the remaining stolen assets tell a grimmer story. The bulk of the haul was bridged through multiple networks and eventually swapped into bitcoin via Thorchain, a cross-chain liquidity protocol that has become a favored tool for hackers seeking to obscure fund trails. That portion is considered extremely difficult to recover.
A Bailout, Not a Recovery
The DeFi United initiative marks a practical acknowledgment that clawing back the stolen funds is unlikely. Instead, the effort focuses on recapitalizing the system to prevent the bad debt from cascading further.
For Aave, the stakes are existential in reputational terms. The protocol holds roughly $14 billion in TVL even after the drawdown and processes billions in daily borrows. Any perception that it can’t absorb or manage exploit-related losses could trigger a deeper confidence crisis.
The KelpDAO exploit also reignited debates about the risks of liquid restaking tokens and bridge security. rsETH was designed as a convenient way to earn staking yields while maintaining DeFi composability, but the bridge vulnerability exposed how fragile that composability can become when a single integration point fails.
What Happens Next
The immediate priority is restoring rsETH’s backing ratio to prevent further liquidation cascades. If the pledged ETH from Lido, EtherFi, and Kulechov materializes – roughly 12,500 ETH combined at current commitments – it would cover approximately 11 percent of the estimated 112,000 rsETH shortfall.
Additional contributions from other protocols and foundations are expected. The Aave governance forum shows active discussion around potential treasury allocations from the Aave DAO itself.
For the broader DeFi sector, the episode serves as both a cautionary tale about bridge security and an unexpected test of whether competing protocols can cooperate in a crisis.
FAQ
What’s the DeFi United initiative?
DeFi United is a coordinated bailout effort led by Aave, with participation from Lido Finance, EtherFi, and Aave founder Stani Kulechov. The goal is to restore rsETH backing and prevent bad debt from spreading across lending markets after the $292 million KelpDAO exploit.
How much was stolen in the KelpDAO hack?
The attacker exploited a vulnerability in KelpDAO’s LayerZero bridge integration to mint 116,500 unbacked rsETH tokens. The total value of the exploit is estimated at $292 million, making it the largest crypto theft of 2026 so far.
Can the stolen funds be recovered?
Much of the stolen capital was bridged through multiple networks and swapped into bitcoin via Thorchain, making full recovery unlikely. The DeFi United effort focuses on recapitalizing the system rather than pursuing the stolen assets directly.
