Aave DAO is voting on whether to send 25,000 ETH, worth roughly $58 million, from its treasury into a coalition rescue fund for users hit by the April 18 Kelp DAO bridge exploit. If the vote passes, Aave becomes the largest single donor inside DeFi United, a $300 million-plus industry response to the $292 million theft of 116,500 rsETH that left Aave V3 markets on Ethereum, Arbitrum, and Mantle holding under-collateralized positions. The proposal, advanced by Aave service provider TokenLogic, frames the contribution as a defense of depositor confidence rather than a bailout. The vote is the clearest test yet of whether DeFi protocols will absorb losses from third-party failures or push them onto users.
rsETH is a liquid restaking token, meaning a derivative that represents staked ETH plus a claim on additional yield from securing other networks. When Kelp DAO’s LayerZero bridge was drained, the rsETH circulating on remote chains lost the Ethereum collateral that was supposed to back it.
Key takeaways
- Aave DAO is voting on a 25,000 ETH (~$58M) contribution to DeFi United, the largest single pledge in the $303M coalition.
- Aave founder Stani Kulechov is personally pledging 5,000 ETH; Senior VP Emilio Frangella has pledged 500 ETH.
- Total DeFi United commitments stand at roughly 132,650 ETH across Consensys, Lido, EtherFi, Ethena, Mantle, LayerZero, and others.
- The April 18 Kelp DAO exploit, attributed to North Korea’s Lazarus Group, drained 116,500 rsETH (~$292M) and triggered a public dispute between Kelp and LayerZero over bridge defaults.
Published: April 30, 2026
How a single bridge break became an industry referendum
The April 18 attack was not a smart contract flaw. According to Chainalysis, attackers compromised two internal RPC nodes that fed price and state data to the LayerZero Decentralized Verifier Network, then DDoSed the external node the network was supposed to fall back to. The DVN accepted forged cross-chain messages and minted 116,500 rsETH on remote chains with no Ethereum locked behind it.
Much of that synthetic rsETH made its way into Aave V3 markets, where users borrowed against it. When the exploit became public, those positions were instantly insolvent. Aave paused the affected markets, but the bad debt did not disappear. Aave Labs, Kelp DAO, and LayerZero have since pushed an Arbitrum governance vote to release roughly 30,765 ETH frozen by the network’s Security Council into the recovery effort.
Who is paying, and who is not
DeFi United has secured 132,650 ETH in pledges and credit lines, valued near $303 million. According to The Block, Aave’s 25,000 ETH commitment would anchor the fund. Consensys and founder Joseph Lubin are contributing up to 30,000 ETH. Lido is allocating up to 2,500 stETH. Compound has proposed up to 3,000 ETH. Mantle is offering a low-interest credit facility of up to 30,000 ETH for any remaining bad debt. EtherFi, Ethena, Ink Foundation, BGD Labs, and Golem round out the coalition.
What the vote is actually deciding is who absorbs losses when a third-party bridge fails. Aave depositors did not choose to use the LayerZero DVN. Kelp DAO’s configuration, LayerZero’s defaults, and the attackers chose for them. As reported by The Defiant, Tokédex founder Robby Greenfield argued the proposal asks much of the DAO “without requiring, as a precondition, any systemic reform to prevent the exact same failure from recurring.” TokenLogic countered that conditioning disbursement on parallel risk reforms would introduce delay “at a moment that requires broader, industry-wide, aligned action.”
The recovery mechanics
The recovery plan converts pledged ETH into rsETH in staged tranches and deposits the tokens into the affected lockbox contract on Ethereum. That restores the 1:1 backing for rsETH on remote chains. Once backing is restored, DeFi United expects to unpause and unfreeze rsETH and ETH across affected markets and reverse the emergency loan-to-value adjustments that Aave imposed after the exploit.
None of it happens automatically. The Aave proposal needs to pass governance. The Arbitrum proposal to release frozen ETH needs separate approval. Legal agreements between coalition members must close. Aave Labs estimates the full process could take approximately 49 days. New security measures on LayerZero and Kelp DAO remain “in production,” meaning untested at scale.
The blame and the precedent
LayerZero and Kelp DAO continue to publicly disagree over fault. LayerZero says Kelp ignored repeated guidance to move from a single-DVN setup to a multi-verifier configuration. Kelp counters that LayerZero’s own quickstart guide and default GitHub configuration use the same 1-of-1 setup, and that roughly 40% of protocols on LayerZero ship with that default today.
The Aave vote does not resolve that dispute. It does set a template. If Aave’s depositors are made whole through coalition-funded ETH rather than Kelp DAO equity, an insurance precedent, or LayerZero treasury, the message to the rest of DeFi is that exploits get socialized across willing protocols. If the vote fails, the precedent flips: depositors absorb losses from infrastructure they did not choose.
FAQ
What is DeFi United?
DeFi United is a coalition of DeFi protocols, infrastructure providers, and individual contributors that formed in late April 2026 to restore the backing of rsETH after the Kelp DAO exploit. It has secured roughly $303 million in pledges. Members include Aave, Consensys, Lido, EtherFi, Ethena, Mantle, Compound, LayerZero, Ink Foundation, and BGD Labs.
What is rsETH and why did its backing break?
rsETH is a liquid restaking token issued by Kelp DAO that represents staked Ethereum plus restaking yield. Its remote-chain versions are normally backed 1:1 by ETH locked in a Kelp bridge contract. The April 18 exploit minted 116,500 rsETH on remote chains without locking the corresponding ETH, breaking the backing invariant.
When does the Aave DAO vote close?
Voting opened in late April 2026 and is ongoing. Aave Labs estimates that, if the proposal passes and downstream governance approvals follow, full rsETH restoration could take approximately 49 days from the start of the recovery process.
