Exposure, Recovery & Pledges
All figures in USD · ETH amounts at ~$2,350/ETH
Updated Jun 13, 2026 · 9 contributors tracked
The KelpDAO rsETH exploit, documented.
An independent record of the April 18 bridge incident and the DeFi United relief effort. Every figure links to its primary source.
Initial Drain
~$292M
116,500 rsETH (~18% of supply)
Recoverable
87,955 ETH
Kelp 43k + Arbitrum 30.7k + liquidations
Remaining Shortfall
~75,081 ETH
From 163,183 ETH initial gap
DeFi United Raised
$221.65M
100,338 ETH on-chain · defiunited.world
DeFi United Contributions
Confirmed Proposed
What happened?
On April 18, 2026, an attacker — Chainalysis attributes it to DPRK-linked Lazarus Group — exploited a 1-of-1 LayerZero DVN on the KelpDAO bridge and minted 116,500 unbacked rsETH (~$292M, ~18% of circulating supply). KelpDAO's pauser multisig froze contracts 46 minutes later; Aave, SparkLend and Fluid froze rsETH markets. A Fluid-led consortium launched an aWETH redemption protocol that processed $136M in the first 48 hours. The Aave service-providers ARFC tallies 87,955 ETH recoverable across Kelp's claw-back, Arbitrum's 30,766 ETH freeze and hacker-position liquidations on Aave and Compound, cutting the 163,183 ETH shortfall to ~75,081 ETH. On April 25, the Aave DAO opened an ARFC to add 25,000 ETH from its own treasury — making it the largest single pledge. Per the official tracker defiunited.world, on-chain receipts already total $221.65M across 69,299 wallets. Ether.fi's DAO vote has passed; Aave, Mantle and Lido proposals remain in governance.