DeFi United is a coordinated relief initiative led by Aave service providers to fully restore the backing of KelpDAO's rsETH liquid restaking token following the April 18, 2026 LayerZero bridge exploit. The effort spans token contributions from major Ethereum protocols and foundations, frozen-fund releases coordinated through L2 governance and the courts, and a multi-step technical plan to clear bad debt across Aave and Compound.

The recovery has now been executed in full: rsETH is fully backed, withdrawals have reopened, and Aave's affected WETH markets have been restored to standard parameters. This page summarizes the complete timeline.

On April 18, 2026, at approximately 17:35 UTC, an attacker released 116,500 rsETH from KelpDAO's bridge contract on Ethereum mainnet without a corresponding burn on L2. The amount represented roughly 18% of the rsETH circulating supply and was valued at approximately $290 million at the time of the exploit. The attacker exploited a single point of failure in KelpDAO's 1-of-1 Decentralized Verifier Network (DVN), in which LayerZero Labs' DVN acted as the sole verifier.

The funds were distributed across multiple wallets and used as collateral on Aave V3, Compound V3, and Euler, allowing the attacker to borrow an estimated $236 million in WETH. Aave's bad debt exposure across deployments was estimated to potentially exceed $170 million.

LayerZero Labs initially attributed the attack to North Korea's Lazarus Group, identifying it as an RPC-poisoning attack against the DVN's verification path.

Aave froze its ETH and LST markets to contain bad debt accrual and prevent further withdrawals against compromised collateral. To give stranded aWETH lenders an exit, Fluid launched an aWETH redemption protocol and shortly after extended it to L2.

On April 21, the Arbitrum Security Council froze 30,765.67 ETH connected to the exploiter on Arbitrum One. Of the moved funds, 75,700 ETH had already been swapped by the DPRK via THORChain before the freeze.

On April 24, Aave service providers launched DeFi United, a deficit relief initiative to cover the estimated 118,000 ETH shortfall in rsETH backing. Initial pledges came from across the Ethereum ecosystem:

• EtherFi: 5,000 ETH

• Lido: 2,500 ETH

• Golem: 1,000 ETH

• Stani Kulechov (personal): 5,000 ETH

• Mantle: a loan facility extended to the Aave DAO

Ethena, Ink Foundation, Tydro, and LayerZero also signaled participation without specifying initial amounts. Stani Kulechov publicly called on THORChain to contribute the roughly $450,000 in swap fees its protocol generated from the DPRK's exploit-related swaps.

On April 24, the Aave DAO formally offered to contribute 25,000 ETH to DeFi United, the single largest pledge to the initiative. Hours later, the Ethereum Foundation swapped aWETH for wstETH, a market-supportive position rather than a direct contribution but one that signaled foundational alignment with the recovery.

By April 27, Aave founder Stani Kulechov confirmed that DeFi United had secured sufficient funds to fully restore rsETH's backing, with execution pending governance approvals and finalization of indicative agreements. Consensys and Joseph Lubin committed 30,000 ETH to the initiative the same day, and LayerZero formally contributed 5,000 ETH on April 28.

On April 28, Aave published the technical implementation plan for the recovery. The plan has two parallel tracks.

First, ETH commitments are converted to rsETH in tranches and deposited into the bridge lockbox, allowing rsETH to return to its nominal 1.07 ETH exchange ratio and the bridge to resume operations.

Second, governance proposals on Ethereum and Arbitrum will temporarily adjust rsETH's oracle price to enable controlled liquidations of the 107,000 rsETH still held as collateral by exploiter addresses across Aave and Compound. The recovered rsETH is then redeemed for ETH through Kelp and used to clear the deficits on both networks. Once the recovery completes, all temporary configuration changes are reverted and frozen markets are unfrozen, allowing lenders to withdraw.

Aave noted that successful execution relies on the attacker not interfering with the liquidation sequence.

On May 2, Aave executed the controlled liquidation step, seizing approximately 89,567 rsETH from the attacker's positions across Ethereum mainnet and Arbitrum V3 markets via the temporary oracle adjustment described in the implementation plan.

On May 4, ArbitrumDAO voted 90.96% in favor of routing the 30,765.67 ETH frozen on Arbitrum One to the DeFi United recovery multisig. Mantle DAO followed on May 5 by authorizing its treasury to lend up to 30,000 ETH to the Aave DAO to help cover bad debt from the exploit.

On May 8, a court signed an order clearing ArbitrumDAO to transfer the frozen 30,765 ETH to Aave LLC. Aave subsequently amended the Constitutional AIP to route the funds to a wallet controlled by Aave LLC, replacing the original 3-of-4 Gnosis Safe structure to comply with the court order.

On May 12, the final stage of the recovery began as Kelp and Aave burned the seized rsETH on Arbitrum, refilling the 117,132 rsETH deficit and preparing withdrawals to reopen.

On May 14, KelpDAO and Aave unpaused rsETH withdrawals, bridging, and claims, with rsETH confirmed as fully backed thanks to DeFi United funds. The same day, Aave restored LTV parameters across all V3 WETH deployments affected by the exploit, while KelpDAO consolidated bridging support and trimmed 20 chains.

On May 16, LayerZero Labs published its full post-mortem on the $292 million attack, tracing it to TraderTraitor, a compromised developer machine, and poisoned internal RPC nodes — confirming and expanding on the initial RPC-poisoning attribution.

The DeFi United recovery is complete. rsETH is fully backed at its nominal exchange ratio, withdrawals and bridging have reopened, and Aave's affected WETH markets are operating under standard parameters. The frozen 30,765 ETH on Arbitrum has been routed to Aave LLC per court order, the attacker's rsETH collateral has been liquidated and burned, and the LayerZero post-mortem has formalized the attack path.

For the full archive of DeFi United coverage, see the defi-united category.

Disclaimer: Content is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. No representations or warranties are made as to accuracy, completeness, or timeliness. Use of this content is at your own risk, and you should consult a qualified professional before making decisions. No fiduciary or advisory relationship is created

• Visa expands stablecoin pilot.

• EF ESP allocates $9.8m in Q1 2026.

• Solidity v0.8.35 ships ERC-7201.

• Ethereum hits 3.6m daily txs.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Visa expanded its stablecoin settlement pilot to five new chains, including Base and Polygon, bringing its total supported blockchains to nine. The pilot has reached a $7 billion annualized run rate and builds on regional rollouts across Latin America, Europe, Asia Pacific, and CEMEA, alongside the recent expansion of USDC settlement to U.S. banks and over 130 stablecoin-linked card programs. Read more.

The Ethereum Foundation's Ecosystem Support Program (ESP) published its Q1 2026 funding allocation, distributing $9.8 million across 57 projects spanning protocol research, cryptography, ZK proofs, security, privacy, and developer tooling. The quarter emphasized formal verification of zkVM systems, ZK trace construction optimizations, and cryptanalysis of the Poseidon hash function. Read more.

The Solidity team released version 0.8.35 of the compiler, delivering new language features, an experimental codegen pipeline, and early warnings ahead of the upcoming 0.9.0 release. The headline feature is ERC-7201, Solidity's first compile-time builtin, which automatically computes the base storage slot for namespaced storage layouts. The release also issues deprecation warnings for identifiers that will become reserved keywords in 0.9.0. Read more.

• Ethereum hits daily txs ATH

• Foundry v1.7.0 release

• Smart Node v1.20.2 release

• Stani reflects on DeFi United

• Luigi joins the Aave team

• Lido DAO approves 2,500 ETH

• How EtherFi handled rsETH incident

• Lens DeFi United badge

• ZKsync protocol upgrade v31

• Ethena minted 100M USDm

• Uniswap Community SDK

• Governance Review #93

• Link smart wallet update

• Privy digital asset accounts

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

The Solidity team released version 0.8.35 of the Solidity compiler, delivering new language features, an experimental codegen pipeline, and early warnings ahead of the upcoming 0.9.0 release. The headline feature is ERC-7201, Solidity's first compile-time builtin. It automatically computes the base storage slot for ERC-7201 namespaced storage layouts, eliminating the need for developers to hardcode values.

The release also issues deprecation warnings for identifiers that will become reserved keywords in the 0.9.0 release. Developers are encouraged to audit their codebases now to avoid breaking changes in the next release. Solidity is the most widely used language for developing smart contracts on the EVM, introduced in 2015 and continuously developed alongside the protocol's roadmap toward the Hegotá hardfork.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.