DeFi attack wipes $292 million as $10B exits Aave

The exploit shakes DeFi markets

The attack stemmed from a vulnerability in KelpDAO’s integration with LayerZero. An unidentified attacker manipulated the cross-chain messaging system, successfully minting 116,500 unbacked rsETH tokens. Nearly 90,000 of these tokens were then used as collateral on the Aave platform, allowing the attacker to borrow approximately $190 million in Ethereum and other assets.

The repercussions were immediate. The value of various crypto assets plummeted as lenders rushed to withdraw their funds, causing panic across markets. The total value locked in DeFi protocols dropped from almost $15 billion to $10 billion after the attack. Aave’s incident report indicated that the system was left with an rsETH hole exceeding 112,000 tokens.

Rescue initiative: DeFi United

Spearheaded by Aave, the DeFi United rescue aligns major protocols and companies in a collaborative effort to restore affected platforms. Lido Labs Foundation, part of the staking service Lido Finance, has proposed allocating 2,500 stETH—worth roughly $5.7 million—to the recovery fund. This funding is intended to patch the shortfall in rsETH collateral and curb further liquidations.

Meanwhile, EtherFi stepped forward with a proposal for a rescue package totaling 5,000 ETH, aiming to protect users and prevent the spread of bad debt. Stani Kulechov, Aave’s founder, also pledged a personal contribution of 5,000 ETH to bolster the rescue effort.

Stani Kulechov emphasized, “Aave is my life’s work, and we are working tirelessly to achieve the best outcome for users. I am putting in maximum effort to resolve the issue quickly and return market conditions to normal.”

Aave stated that more industry participants will be joining the alliance, with additional contributions expected to be announced as the details of the recovery plan are finalized.

Fate of stolen funds and new security steps

Following the exploit, a significant portion of the stolen assets was tracked to the Arbitrum network. The Arbitrum security council responded by freezing 30,766 ETH—valued at approximately $71 million. However, another segment of the stolen funds was converted into bitcoin via Thorchain, complicating recovery efforts.

Current initiatives focus less on direct fund retrieval and more on recapitalizing rsETH to limit user losses. Industry leaders repeatedly underline the urgency of improved coordination in blockchain infrastructure to prevent future incidents.

The DeFi United campaign represents a rare collective action among competing platforms, sending a strong signal on the sector’s commitment to user protection and ecosystem stability.

The exploit’s impact has also reignited discussions among investors about the inherent risks in decentralized financial systems, as well as the urgent need for stronger safeguards around cross-chain bridges.

As forensic investigations continue, DeFi protocols are evaluating both technical and governance-based solutions to shore up protocol resilience, with transparency and communication top of mind.

Looking forward, many in the industry see the crisis as an inflection point that could accelerate the adoption of more robust risk management practices and insurance mechanisms to shield DeFi users against systemic shocks.