Aave leads DeFi United to restore rsETH after KelpDAO hack

Aave is leading a coalition called DeFi United to restore backing for rsETH after attackers drained 116,500 rsETH-about $292 million-from KelpDAO’s cross-chain bridge and deposited the stolen tokens as collateral on Aave V3, creating unpaid loans on the lending protocol.

On April 18, the exploited rsETH was posted as collateral on Aave V3 and used to borrow large amounts of Wrapped Ether (WETH). Because the stolen rsETH no longer had underlying stake supporting it, the collateralized positions cannot be liquidated through normal on-chain mechanisms, leaving Aave exposed to bad debt.

Early forensic signals from LayerZero point to the Lazarus Group’s TraderTraitor as the likely perpetrator of the breach. The stolen rsETH retained token form after the theft but lost the underlying stake that gives it value as collateral.

The breach triggered a wave of withdrawals across decentralized finance. Total value locked in DeFi fell from $99.5 billion to $83.7 billion since April 18. Aave’s total deposits dropped from $45.8 billion to $28.6 billion, a decline of $17.2 billion. To limit further exposure, Aave paused rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle and Linea while recovery options are developed.

Several on-chain and off-chain participants have provided indicative commitments to shore up rsETH under the DeFi United initiative. Lido Finance has proposed contributing up to 2,500 staked ether (stETH) to a dedicated relief vehicle. Mantle’s treasury has offered a proposal to lend up to 30,000 ETH to Aave DAO. Aave founder Stani Kulechov pledged 5,000 ETH from his own holdings and wrote on X: “Aave is my life’s work and we’re working nonstop to find the best possible outcome for users. I’m personally contributing 5000 ETH to DeFi United as we continue working together with partners on formalizing more commitments.” The EtherFi Foundation proposed 5,000 ETH, Golem pledged 1,000 ETH, and additional support has come from Ethena, LayerZero, Tydro, the Ink Foundation and Frax Finance.

rsETH is a liquid restaking token that represents staked ETH used to secure other networks while remaining tradable in DeFi. When the stake behind a liquid restaking product is removed or compromised, the token can no longer provide recoverable value as collateral. In this case, rsETH tokens existed on-chain but lacked the underlying stake needed for liquidation.

Aave and its partners are discussing the design of a relief vehicle and the legal and on-chain steps required to re-back or otherwise remediate the compromised rsETH positions. Proposals include direct token contributions to replace lost backing and large ETH loans to Aave DAO to cover shortfalls. Commitments reported so far are indicative as parties work to formalize arrangements and coordinate across chains.

Teams are monitoring on-chain activity tied to the drained rsETH and the borrowed WETH. Governance bodies at the involved protocols are preparing votes and legal reviews. Markets and users will watch whether the pledged commitments are formalized and how quickly any relief capital can be deployed.