Every confirmed event from the KelpDAO drain through the DeFi United relief effort.
Attacker exploited the KelpDAO bridge by feeding a forged LayerZero packet through a 1-of-1 DVN, minting 116,500 rsETH (~$292M, ~18% of circulating supply) to an attacker-controlled address. Chainalysis attributes the attack to DPRK-linked Lazarus Group, which compromised internal RPC nodes and DDoSed external ones to falsify verification data.
Kelp's emergency pauser multisig froze the core contracts 46 minutes after the drain. Two follow-up attempts at 18:26 UTC and 18:28 UTC both reverted, each carrying another LayerZero packet attempting to drain ~40,000 rsETH (~$100M).
Lending protocols froze rsETH markets to prevent further bad debt accumulation. Aave had ~90,000 rsETH deposited as collateral against ~$190M borrowed in ETH and other assets across Ethereum and Arbitrum.
In the 24 hours after the hack, whales pulled over $6B from Aave, pushing ETH, USDT and USDC pools to 100% utilization. Stranded users then borrowed ~$300M against their own trapped stablecoin deposits just to exit — a "borrowing spike" that was really a distress signal.
Fluid, in consortium with Lido, Ether.fi, 1inch, 0x and Kyber, launched an aWETH redemption vault in under 24 hours. Lenders deposit aWETH in exchange for wstETH or weETH; the vault uses the aWETH to repay its own Aave WETH debt. Capacity capped at $1B. $136M processed in the first 48 hours.
Contagion from the Kelp hack wiped more than $13B from total DeFi TVL within 48 hours — the largest 2-day outflow of 2026. AAVE token fell ~26% on the week.
Aave service providers publish the incident report and formally announce the DeFi United effort to coordinate industry relief with ecosystem partners.
LlamaRisk estimates Aave bad debt between $123.7M (if socialized across rsETH holders) and $230.1M (isolated to L2s, concentrated on Arbitrum and Mantle).
Arbitrum's Security Council froze 30,766 ETH (~$71M) linked to the exploit, moving the attacker-controlled funds into an intermediary wallet.
Over ~36 hours starting April 21, the attacker routed ~75,700 ETH (~$175M) through THORChain's native ETH→BTC swaps — permissionless, non-custodial, and with no freeze mechanism once initiated. THORChain's 24h volume surged to ~$394M (≈11× normal) and fees jumped ~$910K. BTC conversion moves the funds beyond Arbitrum/L2 freezes.
Mantle Treasury proposes a 30,000 ETH loan to Aave DAO (~$69.4M) at Lido yield + 1%, 36-month maturity, with optional early repayment. Proposal also seeks delegation of 130,000 AAVE tokens for governance participation. Still in discussion — pending Mantle forum poll, Snapshot vote, and Aave DAO approval.
Aave founder Stani Kulechov personally commits 5,000 ETH to the DeFi United relief effort.
rsETH traded at a premium until April 20, then cracked: it fell from ~$2,404 to $1,723 on April 23 (~$540 gap from ETH at ~$2,270). It partially recovered the next day to ~$2,108 (+17.4% 24h) as recovery plans firmed up.
Lido Labs Foundation puts forward a proposal to allocate up to 2,500 stETH (~$5.7M) to the DeFi United relief vehicle to reduce the rsETH backing shortfall.
Ether.fi Foundation's 5,000 ETH contribution passes the ether.fi DAO with unanimous support across 1,800 token holders. Funds earmarked for compensating user losses and stabilizing debt across Aave and other platforms. A detailed distribution roadmap is promised within 7 days.
ACI founder Marc Zeller floats a dedicated Aave vault: a share of Aave's WETH income routed into a 5%-yield-capped pool, with deposits tokenized as a tradable "AaveETH" asset. The mechanism would let users help cover the deficit through both interest and principal repayments.
Aave service providers' rsETH Incident Funding ARFC tallies 87,955 ETH of recoverable funds across four sources: ~43,168 ETH clawed back by Kelp, 30,766 ETH frozen by Arbitrum's Security Council, ~12,323 ETH from liquidating the hacker's Aave positions, and ~1,845 ETH from Compound liquidations. Against the 163,183 ETH original shortfall (152,577 rsETH at the 1.0696 ratio), the remaining gap is ~75,081 ETH. Public pledges stand at 14,570 ETH across eight named contributors, separate from Mantle's proposed 30,000 ETH credit facility and Aave's pending 25,000 ETH treasury request.
Frax Finance joins the DeFi United coalition despite no direct rsETH exposure, citing solidarity with Aave. Frax flagged a forthcoming governance vote to outline a structured, incentive-aligned approach to support Aave markets.
Aave service providers submit an ARFC asking the Aave DAO treasury to contribute 25,000 ETH to DeFi United, going toward restoring rsETH backing and normalizing markets. If passed, Aave becomes the single largest donor and pushes coalition pledges to ~69,350 ETH (~$163M).
Lookonchain tallies 69,642 ETH (~$161M) committed to the DeFi United relief vehicle from 14 ecosystem partners and individuals — including Aave (proposed 25,000 ETH), Mantle (up to 30,000 ETH credit facility), Stani Kulechov (5,000 ETH), Ether.fi (5,000 ETH), Lido (up to 2,500 stETH), Golem (1,000 ETH), Frax Finance, Ethena, Ink Foundation/Tydro, LayerZero, BGD Labs, and individual contributors Emilio and Ernesto — one of the largest emergency funds in DeFi history.