DeFi United is a coordinated relief initiative led by Aave service providers to fully restore the backing of KelpDAO's rsETH liquid restaking token following the April 18, 2026 LayerZero bridge exploit. The effort spans token contributions from major Ethereum protocols and foundations, frozen-fund releases coordinated through L2 governance, and a multi-step technical plan to clear bad debt across Aave and Compound.

This page summarizes the full timeline and the mechanics of the recovery.

On April 18, 2026, at approximately 17:35 UTC, an attacker released 116,500 rsETH from KelpDAO's bridge contract on Ethereum mainnet without a corresponding burn on L2. The amount represented roughly 18% of the rsETH circulating supply and was valued at approximately $290 million at the time of the exploit. The attacker exploited a single point of failure in KelpDAO's 1-of-1 Decentralized Verifier Network (DVN), in which LayerZero Labs' DVN acted as the sole verifier.

The funds were distributed across multiple wallets and used as collateral on Aave V3, Compound V3, and Euler, allowing the attacker to borrow an estimated $236 million in WETH. Aave's bad debt exposure across deployments was estimated to potentially exceed $170 million.

LayerZero Labs subsequently attributed the attack to North Korea's Lazarus Group, identifying it as an RPC-poisoning attack against the DVN's verification path.

Aave froze its ETH and LST markets to contain bad debt accrual and prevent further withdrawals against compromised collateral. To give stranded aWETH lenders an exit, Fluid launched an aWETH redemption protocol and shortly after extended it to L2.

On April 21, the Arbitrum Security Council froze 30,765.67 ETH connected to the exploiter on Arbitrum One. Of the moved funds, 75,700 ETH had already been swapped by the DPRK via THORChain before the freeze.

On April 24, Aave service providers launched DeFi United, a deficit relief initiative to cover the estimated 118,000 ETH shortfall in rsETH backing. Initial pledges came from across the Ethereum ecosystem:

• EtherFi: 5,000 ETH

• Lido: 2,500 ETH

• Golem: 1,000 ETH

• Stani Kulechov (personal): 5,000 ETH

• Mantle: a loan facility extended to the Aave DAO

Ethena, Ink Foundation, Tydro, and LayerZero also signaled participation without specifying initial amounts. Stani Kulechov publicly called on THORChain to contribute the roughly $450,000 in swap fees its protocol generated from the DPRK's exploit-related swaps.

On April 24, the Aave DAO formally offered to contribute 25,000 ETH to DeFi United, the single largest pledge to the initiative. Hours later, the Ethereum Foundation swapped aWETH for wstETH, a market-supportive position rather than a direct contribution but one that signaled foundational alignment with the recovery.

By April 27, Aave founder Stani Kulechov confirmed that DeFi United had secured sufficient funds to fully restore rsETH's backing, with execution pending governance approvals and finalization of indicative agreements. Consensys and Joseph Lubin committed 30,000 ETH to the initiative the same day, and LayerZero formally contributed 5,000 ETH on April 28.

On April 28, Aave published the technical implementation plan for the recovery. The plan has two parallel tracks.

First, ETH commitments are converted to rsETH in tranches and deposited into the bridge lockbox, allowing rsETH to return to its nominal 1.07 ETH exchange ratio and the bridge to resume operations.

Second, governance proposals on Ethereum and Arbitrum will temporarily adjust rsETH's oracle price to enable controlled liquidations of the 107,000 rsETH still held as collateral by exploiter addresses across Aave and Compound. The recovered rsETH is then redeemed for ETH through Kelp and used to clear the deficits on both networks. Once the recovery completes, all temporary configuration changes are reverted and frozen markets are unfrozen, allowing lenders to withdraw.

Aave noted that successful execution relies on the attacker not interfering with the liquidation sequence.

DeFi United has secured commitments exceeding the 118,000 ETH shortfall. Aave has submitted a governance proposal to the Arbitrum DAO requesting release of the 30,765.67 ETH into a 2-of-3 Gnosis Safe controlled by Aave Labs, KelpDAO, and Certora. The full AIP governance process is estimated to take approximately 49 days. Detailed next steps for affected users are expected to be released by Aave in the coming days.

This page will be updated as the recovery progresses. For the full archive of DeFi United coverage, see the defi-united category.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

• SoP relaunches as Protocol Institute.

• LayerZero contributes 5k ETH to DeFi United.

• DeFi United technical recovery plan.

• Ethereum issuance reduction discussions.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

The Summer of Protocols, originally seeded by the Ethereum Foundation, relaunched as The Protocol Institute, a new initiative to advance the study, design, and stewardship of protocols across research, entrepreneurship, governance, culture, and education. Read more →

LayerZero pledged 5,000 ETH to DeFi United and another 5,000 ETH to support Aave market liquidity, bringing its total commitment to 10,000 ETH. DeFi United's total fundraise has surpassed 137,708 ETH (~$315M). Read more →

Aave published its technical plan for DeFi United, using temporary rsETH oracle adjustments on Ethereum and Arbitrum to liquidate 107,000 rsETH held across seven exploiter addresses on Aave and Compound. Recovered rsETH will be redeemed through Kelp to clear the deficits. Read more →

• Ethereum issuance reduction discussions-

• from: Dima Gusakov, Evan Van Ness, and Tom Lee.

• Nouns statement on Proposal 955.

• Charon v1.10 release.

• This week in Enterprise Onchain.

• Privacy Boost on Soneium.

• Human Protocol with Griff Green.

• Etherscan to hide low-value txs.

• Foundation goes offline.

• Puffer contributes to DeFi United.

• EtherFi cuts off 8 L2s.

• Polymarket CLOB update.

• CoW Swap turns 5.

Reach 10,000+ Ethereum-native subscribers every weekday. Daily issues and dedicated send slots are open. Please get in touch to book a placement.

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

Aave published its technical implementation plan for DeFi United, a coordinated effort to recover the backing of KelpDAO's rsETH LST following the LayerZero bridge exploit on April 18, 2026. Beyond restoring rsETH's full backing, the recovery plan also includes steps to recover the 107,000 rsETH being used as collateral across seven exploiter addresses on Aave and Compound Finance.

Yesterday, DeFi United announced that it secured sufficient ETH commitments to bring rsETH back to its nominal 1.07 ETH exchange ratio. The ETH will be converted to rsETH in tranches and deposited into the bridge lockbox, allowing the bridge to resume operations.

Recovering the rsETH collateral in DeFi will involve governance proposals to temporarily adjust rsETH's oracle price on both Ethereum and Arbitrum, enabling controlled liquidations of the exploiter's positions. The recovered rsETH will then be redeemed for ETH through Kelp and used to clear the resulting deficits on both networks. Compound will execute a similar process.

Once the recovery is complete, all temporary configuration changes will be fully reverted, and frozen markets will be unfrozen, allowing lenders to withdraw collateral. Aave noted that the successful execution relies on the attacker not interfering with the liquidation sequence.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.