finance
$190 Million Crypto Exploit Hits KelpDAO and Aave; DeFi Groups Initiate Recovery Plan
An attacker exploited a vulnerability in KelpDAO’s integration with LayerZero to mint unbacked rsETH tokens and borrow $190 million from Aave. Industry players, including Lido Finance and EtherFi, are coordinating a bailout to restore token backing and prevent bad debt. The incident caused a $10 billion plunge in Aave's total asset value.
Apr 23, 4:52 PM·1m read1 source
Substrate placeholder — needs reviewAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
An attacker exploited a vulnerability in KelpDAO’s integration with LayerZero on April 23, 2026, minting 116,500 unbacked rsETH tokens using the bridge’s messaging system, CoinDesk reported. The attacker then deposited nearly 90,000 rsETH tokens into Aave as collateral and borrowed about $190 million in ETH and other assets across Ethereum and Arbitrum.
This exploit left Aave with impaired collateral, prompting lenders to rush and withdraw available funds from the protocol.
The total value of assets on Aave plunged by $10 billion following the incident. Aave's incident report estimated the total hole in collateral at more than 112,000 rsETH. Earlier this week, Arbitrum’s security council froze 30,766 ETH worth roughly $71 million tied to the exploit, while the remaining stolen funds were bridged and swapped into bitcoin via Thorchain.
Aave and partners are now coordinating a recovery effort named 'DeFi United' led by Aave service providers. The recovery effort aims to restore the backing of rsETH, a yield-bearing derivative token of ether (ETH). Aave stated in a post on X that multiple participants have already made indicative commitments to support the recovery effort.
7 million into a dedicated relief vehicle. EtherFi proposed a 5,000 ETH plan to protect users and prevent bad debt across DeFi. Stani Kulechov offered a 5,000 ETH contribution to the recovery effort.
Stani Kulechov said 'Aave is my life's work and we're working nonstop to find the best possible outcome for users' in an X post. ' These commitments follow the exploit's ripple effects, which CoinDesk described as the biggest crypto exploit of the year rattling DeFi lending markets.
