Aave’s emergency fundraising campaign has now collected $160 million of the roughly $200 million required to plug the hole left by the Kelp DAO exploit, according to blockchain analytics firm Arkham. The figure represents about 80% of the target, a pace that would have seemed improbable just days ago when withdrawals were cascading through DeFi’s lending stack.
The funds are flowing into a wallet labeled defiunited.eth, the on-chain address for DeFi United, a bailout vehicle assembled by Aave service providers in the wake of this year’s largest decentralized finance breach. Arkham identified Mantle and Aave DAO as the heaviest contributors, together committing 55,000 ETH, or about $127 million at Ethereum’s current price of roughly $2,346.
Mantle and Aave DAO Shoulder Most of the Load
The arithmetic here is worth pausing on. Two entities, Mantle and Aave DAO, account for nearly 80% of the funds raised so far. That concentration says something about how thin the ranks of willing rescuers really are when a crisis hits a protocol of Aave’s scale.
Mantle, the layer-2 network backed by BitDAO, has been expanding its footprint across Ethereum-based DeFi infrastructure. Its willingness to step into a messy situation like this may be partly strategic, an effort to demonstrate that it can backstop critical infrastructure when others hesitate. Aave DAO’s contribution is more straightforward: it’s protecting the protocol’s own balance sheet and its depositors’ confidence.
Stani Kulechov, Aave’s founder, added a personal stake to the pile: 5,000 ETH, worth approximately $11.73 million. “I’m personally contributing 5,000 ETH to DeFi United as we continue working together with partners,” Kulechov stated. That’s not a trivial sum, even for someone who has built a multi-billion-dollar protocol. It signals that leadership has skin in the game beyond governance tokens and reputation.
The Exploit That Triggered a $10 Billion Bank Run
The funds are needed because an attacker found a vulnerability in KelpDAO’s integration with LayerZero and exploited it to mint 116,500 rsETH tokens that were completely unbacked. Those tokens then circulated through lending markets as if they were legitimate collateral.
When the exploit surfaced, lenders on Aave did the rational thing: they ran for the exits. The platform experienced withdrawals totaling $10 billion as depositors scrambled to pull their assets before the bad collateral could infect their positions. As we reported in our coverage of the initial hack triggering bank-run fears, the speed of capital flight was remarkable even by crypto standards.
RsETH is a yield-bearing derivative of Ether, the kind of token that sits at the core of composable DeFi strategies. When confidence in rsETH collapsed, it created cascading effects across every protocol that accepted it as collateral. The $292 million headline number understates the systemic stress the exploit created.
Not all of that $10 billion in withdrawals represented actual value destruction. Much of it was leveraged positions unwinding, positions that existed only because of borrowed capital stacked on borrowed capital. But distinguishing between real losses and deleveraging doesn’t help Aave’s immediate problem: the protocol was left holding impaired collateral that needs to be written off or recapitalized.
How DeFi United’s Bailout Mechanism Works
DeFi United is essentially a coordinated recapitalization effort. The strategy focuses on restoring support for rsETH by injecting real capital to back the tokens that shouldn’t have existed in the first place.
Think of it like this: imagine a bank discovers that someone has been depositing counterfeit bills and taking out real loans against them. The bank can either write off the losses (painful for shareholders), try to recover the counterfeit bills (unlikely if the criminal is gone), or find outside capital to make depositors whole. DeFi United is pursuing the third option.
The on-chain nature of the effort adds a layer of transparency that traditional finance bailouts lack. Anyone can verify how much has been contributed by watching the defiunited.eth wallet. The current derivatives and lending markets continue to process this information in real time, with funding rates and borrowing costs reflecting the evolving confidence levels.
Whether $200 million is actually sufficient remains an open question. The target appears to be based on estimates of the bad debt left on Aave’s books, but DeFi accounting is messier than corporate accounting. Some of that debt may prove recoverable, some may not. The protocol’s market position depends on whether this capital injection can restore enough confidence to reverse the flight of deposits.
Competitors Benefit From Aave’s Distress
While Aave has been fighting for its balance sheet, competitors have been collecting the outflows. Spark, a lending protocol that emerged from MakerDAO’s ecosystem, saw its total value locked jump from $1.8 billion to $2.9 billion over the weekend. Users who fled Aave needed somewhere to park their capital, and Spark was apparently considered a safer harbor.
That $1.1 billion swing represents a significant redistribution of DeFi market share in just a few days. It’s a reminder that protocol dominance is never permanent. Aave has been the largest decentralized lending platform for years, but users will move fast when they sense trouble.
The broader DeFi sector, tracked on our sectors dashboard, shows mixed signals. Total value locked has dropped substantially, but not all of that reflects permanent capital destruction. Some of it is leveraged positions unwinding, and some is simply funds moving to perceived safety. The question for the coming weeks is whether that capital returns to DeFi lending or exits to stablecoins, centralized exchanges, or traditional assets entirely.
A Larger Pattern of Bridge Vulnerabilities
The Kelp DAO exploit follows a pattern that should be familiar by now: cross-chain bridges remain DeFi’s most vulnerable infrastructure. The attack exploited KelpDAO’s integration with LayerZero, a bridging protocol designed to move tokens across chains. When a bridge fails, it doesn’t just affect one network; it creates problems everywhere the bridged token circulated.
As documented in our earlier coverage of how rsETH ended up stranded on 20 chains, the exploit’s reach extended far beyond Ethereum mainnet. Layer-2 holders found themselves questioning whether their rsETH holdings had any backing at all.
The second-largest DeFi exploit of 2026 also targeted cross-chain infrastructure, though through a different mechanism. In late March, an attacker drained at least $270 million from Drift Protocol on Solana by abusing a legitimate feature called “durable nonces.” That attack didn’t exploit a code bug or stolen keys; it weaponized a design feature.
Both incidents highlight a tension in DeFi’s architecture. The composability that makes DeFi powerful, the ability to stack protocols and move assets across chains, also creates attack surfaces that don’t exist in simpler systems. Every integration point is a potential vulnerability. Every bridge is a potential chokepoint.
What Happens If the Full $200 Million Isn’t Raised
The $160 million raised so far covers 80% of the estimated bad debt. That’s progress, but the remaining $40 million isn’t trivial. If contributions stall before reaching the target, Aave faces difficult choices.
One option: the protocol could socialize remaining losses across governance token holders or existing depositors through some form of dilution or haircut. This would be unpopular but might be preferable to prolonged uncertainty.
Another option: Aave could operate with a partially capitalized balance sheet and hope that organic fees gradually repair the deficit over time. This approach risks prolonging the confidence crisis and inviting further deposit flight.
A third possibility: additional large contributors could emerge. The crypto industry has shown a pattern of last-minute rescues when systemically important infrastructure is at stake. Whether any additional whales are willing to step up for the final $40 million will likely determine how quickly this chapter closes.
Governance discussions in the coming days could provide more clarity on the path forward. Market participants tracking the situation should watch both the defiunited.eth wallet balance and the governance proposal discussions for signals about which direction the protocol is heading.
Related Reading
Sources
Not financial advice. This article exists to inform, not to instruct. Every investment decision you make should be backed by your own research.
