Key Takeaways:
- Aave froze rsETH reserves inside hours of the April 18 Kelp DAO exploit, which created as much as $230.1 million in unhealthy debt.
- DeFi United raised $160M by April 25, with Mantle and Aave DAO pledging 55,000 ETH mixed.
- Governance votes on Aave DAO’s 25,000 ETH contribution are ongoing because the protocol works to completely restore rsETH backing.
DeFi United Raises $160M to Backstop Aave
The exploit started at 17:35 UTC, at Ethereum block 24,908,285. Attackers focused Kelp DAO’s Layerzero V2 bridge on the Unichain-to-Ethereum rsETH route, which was configured as a 1-of-1 DVN with no extra verifiers. They submitted a cast inbound packet that minted 116,500 unbacked rsETH tokens, valued at roughly $292 million on the time, and not using a corresponding lock or burn on the supply chain.
The attacker moved shortly. About 89,567 rsETH, value roughly $221 million, was deposited as collateral throughout Aave V3 markets on Ethereum and Arbitrum. The attacker then borrowed round 82,650 WETH, value roughly $191 million, plus smaller quantities of wstETH.
Positions had been left with well being elements between 1.01 and 1.03, making full reimbursement unlikely. Aave‘s good contracts weren’t exploited. The unhealthy debt originated fully from the unbacked exterior collateral.
Aave’s Protocol Guardian responded inside hours. By roughly 19:00 UTC on April 18, all rsETH and wrsETH reserves throughout V3 deployments had been frozen, loan-to-value ratios had been set to zero, and rate of interest fashions had been adjusted to handle liquidity stress.
Aave Labs and threat supervisor Llamarisk revealed a proper incident report on April 20. The report modeled two loss situations relying on how Kelp DAO socializes the shortfall. Within the first situation, a uniform haircut throughout all rsETH holders produces roughly $123.7 million in unhealthy debt on Aave. Within the second, losses remoted to L2 rsETH holders lead to roughly $230.1 million in unhealthy debt, with Mantle and Arbitrum bearing the heaviest publicity. Different estimates positioned Aave’s whole publicity between $196 million and $200 million.
The market responded sharply. Aave’s whole worth locked fell between $6 billion and $9 billion within the days following the incident. The value of AAVE dropped between 10% and 22% within the instant aftermath. Broader DeFi TVL losses exceeded $13 billion in some reviews.
To comprise the fallout, Aave service suppliers launched DeFi United, a multi-protocol reduction fund directing contributions to defiunited.eth, Ethereum handle 0x0fCa5194baA59a362a835031d9C4A25970effE68. The fund targets the rsETH shortfall, initially modeled at 68,900 to over 100,000 ETH, relying on recoveries and closing unhealthy debt figures.
On Saturday, Arkham Intelligence confirmed DeFi United had raised $160 million. Mantle and Aave DAO collectively contributed 55,000 ETH, accounting for roughly $127 million of that whole. Mantle proposed as much as 30,000 ETH structured as a three-year credit score facility at Lido staking yield plus 1%. Aave DAO has proposed 25,000 ETH from its treasury, with governance voting nonetheless in progress.
Aave founder and CEO Stani Kulechov dedicated 5,000 ETH from private funds. Ether.fi pledged 5,000 ETH. Lido DAO provided as much as 2,500 stETH. Smaller contributors embody Golem Basis at 1,000 ETH, Aave VP Emilio Frangella at 500 ETH, and neighborhood donations of greater than 272 ETH reported onchain. Ethena, Layerzero, Ink Basis, Frax, and Tydro additionally offered assist.
The Arbitrum Safety Council froze a portion of attacker funds, decreasing the web hole the fund should cowl. A follow-on malicious packet for 40,000 rsETH was reverted and recovered by Kelp earlier than it could possibly be processed.
DeFi United is described by individuals as one of many largest coordinated restoration efforts in DeFi historical past. Governance votes on pending contributions stay lively, and the fund continues to simply accept donations because the protocol works towards restoring full rsETH backing and clearing remaining unhealthy debt.
