DeFi United Hits $300M Recovery Target, Kelp Exploit Unresolved
DeFi United raised 132,000 ETH worth over $300 million to cover losses from the Kelp DAO exploit, with Consensys and Joseph Lubin pledging 30,000 ETH.[1][3]
- Exploit on April 18 minted 116,500 unbacked rsETH tokens via compromised LayerZero bridge, valued at $292 million.[2]
- Funds used as collateral on Aave triggered liquidity crisis; TVL outflows hit $12-13 billion across DeFi.[2]
- DeFi United formed as multi-protocol effort targeting 68,900-100,000 ETH; reached $160 million on-chain by April 26, $240 million committed by April 27.[2]
- Aave service providers proposed 25,000 ETH from DAO treasury; Circle Ventures bought AAVE tokens for stabilization.[1]
- Solana Foundation deployed USDT to Aave; Arbitrum froze 30,765 ETH for recovery redirection.[2]
- AAVE token fell 10-22%; broader DeFi TVL dropped 17% post-incident.[2]
Exploit Mechanics
Attackers exploited a LayerZero cross-chain bridge to mint unbacked rsETH, Kelp DAO’s restaked ETH token. These tokens collateralized loans on Aave, creating a $196-200 million exposure gap.[2] The cascade pulled $6-9 billion from Aave’s TVL alone.[2] No evidence of private key compromise; bridge vulnerability enabled unauthorized minting.[1][2]
Recovery Coordination
Aave CEO Stani Kulechov promoted DeFi United, securing pledges from Consensys, Circle, and others. On-chain deposits hit $21 million via Dune Analytics, with $215 million pending governance votes as of late April.[2] Aave credited Lubin’s pledge for speeding progress toward the $300 million threshold.[1]
Industry Backing
Solana Foundation’s USDT lending marked its first non-native deployment, supporting Aave amid cross-chain fallout.[2] Sunrise DeFi listed AAVE on Solana. Oak Research noted the 17% DeFi TVL decline, underscoring interconnected risks.[2]
Crypto Market Implications
Bridge exploits like LayerZero highlight cross-chain vulnerabilities over smart contract flaws, with social engineering absent here-pure protocol weakness prevailed.[2] On-chain forensics via Arkham and Dune aided tracking, freezing 30,765 ETH on Arbitrum.[2]
Historical recovery trends show 20-40% of DeFi exploit funds reclaimed via tracing, though bridge attacks lag due to multi-chain dispersion; no direct data on Kelp recoveries yet.[2]
Subscribe to our Social Media for Exclusive Crypto News and Insights 24/7!
Custodial risks elevated for restaked assets like rsETH; self-custody cannot mitigate protocol-level minting flaws.[1][2]
Recovery & Tracing
Stolen amount: 116,500 rsETH (~$292 million).[2]
Seized amount: 30,765 ETH frozen on Arbitrum; remainder unconfirmed in public filings.[2]
Recovery %: $300 million pledged covers shortfall, but full asset recovery status unconfirmed pending governance and tracing.[1][2][3]
Risks & Uncertainties
Governance delays could unwind pledges if Aave DAO rejects treasury allocation. Uncertainty persists on full rsETH burn or attacker liquidation, with $13 billion DeFi outflows signaling prolonged confidence drag.[2]
Pledges buy time, but unresolved bridge fixes leave DeFi’s $200 billion TVL exposed to similar cascades.[2]
[1] https://www.mexc.com/news/1057501[2] https://coin360.com/news/solana-foundation-aave-usdt-defi-united-response
[3] https://www.ainvest.com/news/defi-united-raises-300-million-stabilize-aave-kelpdao-exploit-2604/
