Key Takeaways
On April 18, a single-node vulnerability in KelpDAO’s bridge allowed 116,500 rsETH (~$292M) to be minted without collateral. The attacker posted these tokens as collateral on Aave and borrowed $190M in real assets. Aave was left with irrecoverable bad debt, and DeFi TVL shed $13B within 48 hours.
Aave serves as DeFi’s interest rate anchor and critical infrastructure for dozens of protocols, including Ethena, Lido, and EtherFi. An Aave failure risks a cascading collapse across the entire stack built on top of it. In response, ecosystem participants formed DeFi United as a self-organized rescue coalition.
Funding is the core problem. Umbrella’s automated insurance covers only $55.1M in WETH, against estimated losses of up to $230M. Current fundraising has not reached half of the $100M target. Any shortfall could be passed to existing depositors, creating realistic conditions for an accelerating bank run.
Whether DeFi United can close its funding target within days, and whether the attacker can be identified or stopped, will determine whether the DeFi ecosystem can restore trust at scale.
On April 18, 2026, 116,500 rsETH (approximately $292 million) was drained from KelpDAO’s LayerZero bridge. The root cause was not a smart contract bug. The bridge relied on a single node for message validation, and that node submitted fraudulent data. rsETH was minted without real collateral backing it.
The attacker did not sell the stolen rsETH. Instead, 89,567 rsETH was deposited into Aave as collateral, used to borrow $190 million in ETH and other assets. The collateral was fabricated; the borrowed assets were real. Aave was left holding loans it cannot recover.
Lido: 2,500 stETH (~$5.8M)
EtherFi: 5,000 ETH (~$11.5M)
Golem: 1,000 ETH (~$2.3M)
Stani Kulechov (personal): 5,000 ETH (~$11.5M)
Mantle: 30,000 ETH loan (Lido APR +1%, 3-year term)
Ethena, Ink/Tydro: Amount undisclosed
As news spread, projects across the Aave ecosystem convened and formed “DeFi United.” The following participants have been confirmed to date. As this is not a formal alliance, additional protocols may still join.
Why Now?
In the 48 hours following the exploit, Aave’s TVL fell by $6.6 billion. Across DeFi as a whole, $13 billion in TVL was erased in the same window.
But this is not Aave’s problem alone. Aave functions as DeFi’s benchmark rate infrastructure. Dozens of protocols reference Aave’s collateral structures and interest rates. When that benchmark destabilizes, the fundamental calculus across the ecosystem breaks down: how much can be borrowed, against what collateral, and at what rate.
Aave underpins the revenue structures of dozens of protocols. Ethena routes $412 million in USDe deposits through Aave. Lido and EtherFi rely on Aave as core infrastructure for their stETH and weETH collateral markets. At this point, it is easier to identify protocols with no Aave exposure than those with it.
Simple Analogy
Imagine a major bank suddenly freezing all its loans. Your own account is fine. Other banks are operating normally. But everyone who borrowed from that bank to invest or run a business loses access to capital overnight. As they rush to liquidate other assets, the broader market comes under pressure.
That is Aave’s role in DeFi. Protocols and individual investors that had borrowed against collateral on Aave began unwinding positions simultaneously. The problem is scale: dozens of protocols are connected to Aave, with billions of dollars locked in.
United We Stand, Divided We Fall
Each DeFi United participant is contributing differently, depending on their position. Lido, EtherFi, and Golem are donating outright. Mantle is taking a different approach: a conditional loan of 30,000 ETH, structured with a Lido APR +1% interest rate, a three-year term, and delegation of 130,000 AAVE governance tokens as conditions. It stabilizes the ecosystem while securing treasury yield and governance rights simultaneously.
The calculus differs by participant. The motivation does not. If Aave fails to recover, none of them survive either.
The problem is speed and scale. Aave has an automated insurance mechanism called Umbrella. When the protocol incurs losses, those who have staked assets there absorb them first. In this incident, Umbrella’s coverage capacity is approximately $55.1 million. The loss exposure reaches up to $230 million. The gap is substantial. Combined contributions disclosed to date fall short of even half the $100 million target. Who covers the remainder remains unclear.
(Total staked funds amount to approximately $251.8 million, but Umbrella operates with asset-level isolation. USDC and USDT staking does not cover WETH shortfalls.)
Whatever Umbrella cannot absorb falls on ETH depositors who did nothing wrong. If the shortfall is distributed among those still in the system, a bank run accelerates. DeFi United is, ultimately, a survival mechanism for Aave and everyone tied to it, and a demonstration of how central Aave is to the broader market.
Whether participating projects can close the funding gap within days, or whether the attacker can be identified, will determine how far DeFi’s credibility can be restored.
Disclaimer
This report has been prepared based on materials believed to be reliable. However, we do not expressly or impliedly warrant the accuracy, completeness, and suitability of the information. We disclaim any liability for any losses arising from the use of this report or its contents. The conclusions and recommendations in this report are based on information available at the time of preparation and are subject to change without notice. All projects, estimates, forecasts, objectives, opinions, and views expressed in this report are subject to change without notice and may differ from or be contrary to the opinions of others or other organizations.
This document is for informational purposes only and should not be considered legal, business, investment, or tax advice. Any references to securities or digital assets are for illustrative purposes only and do not constitute an investment recommendation or an offer to provide investment advisory services. This material is not directed at investors or potential investors.
Terms of Usage
Tiger Research allows the fair use of its reports. ‘Fair use’ is a principle that broadly permits the use of specific content for public interest purposes, as long as it doesn’t harm the commercial value of the material. If the use aligns with the purpose of fair use, the reports can be utilized without prior permission. However, when citing Tiger Research’s reports, it is mandatory to 1) clearly state ‘Tiger Research’ as the source, 2) include the Tiger Research logo. If the material is to be restructured and published, separate negotiations are required. Unauthorized use of the reports may result in legal action.
