DeFi Faces $13B Loss After KelpDAO Exploit as Community Rallies to Restore rsETH Backing

DeFi United’s official platform reports over 69,550 ETH raised from 222 wallets across 1,623 transfers, all directed at restoring rsETH backing. This initiative functions as DeFi’s emergency recapitalization desk, resembling a lender of last resort but operating without regulatory oversight, a central bank, or a formal mandate.

Aave’s governance proposal initially estimated the rsETH shortfall at approximately 163,183 ETH. Contributions and freezes—including 43,168 ETH from KelpDAO, 30,766 ETH frozen by the Arbitrum Security Council, up to 12,323 WETH from Aave liquidations, and 1,845 WETH from Compound—reduced the residual funding gap to about 75,081 ETH.

DeFi United’s current coverage stands at roughly 92.5% of the remaining shortfall, leaving approximately 5,632 ETH outstanding. A broader tracker snapshot shows 100,200 ETH committed against a 116,500 ETH target when including the Arbitrum frozen recovery path, bringing total coverage to about 86%. Both figures assume near-full coverage, though most major contributions remain pending governance votes, and several key contributions lack disclosed amounts.

A waterfall chart illustrates the reduction of the rsETH shortfall from 163,183 ETH to a 5,632 ETH remaining gap, with DeFi United covering 92.5% of the residual.

How the Exploit Unfolded

KelpDAO’s rsETH bridge operated under a 1-of-1 configuration, with LayerZero Labs serving as the sole verifier. Research by Galaxy identified that the attacker exploited this setup to unlock 116,500 rsETH from Ethereum mainnet escrow. The stolen tokens were then used as collateral across Aave, Compound, and Euler, enabling the attacker to borrow an estimated $236 million in WETH and wstETH.

Within 48 hours, DeFi’s total value locked (TVL) plummeted by roughly $13 billion. Aave alone experienced a loss of about $8.45 billion in TVL, with WETH utilization reaching 100% as users rushed to exit positions. This surge in activity also pushed USDT and USDC pools to full utilization.

LayerZero Labs described the attack as RPC poisoning targeting its decentralized validator network (DVN), stopping short of attributing the flaw to the LayerZero protocol itself. The bridge’s reliance on LayerZero Labs as the sole verifier created a single point of failure, with the company’s undisclosed contribution remaining one of the most critical missing pieces in the recovery effort. DeFi United lists LayerZero’s status as “Confirmed, TBD.”

Key Contributions and Their Impact

The following table outlines major contributions to the rsETH recovery effort:

• Mantle – Pending vote – 30,000 ETH
  The largest disclosed contribution, central to closing the funding gap.
• Aave DAO – Pending vote – 25,000 ETH
  Serves as a core treasury backstop and tests DAO willingness to absorb losses.
• Stani Kulechov – Committed – 5,000 ETH
  A founder-level commitment that enhances credibility for the recovery effort.
• EtherFi – Pending vote – 5,000 ETH
  Represents a significant contribution from a major DeFi protocol.