Aave and several major crypto firms are coordinating a recovery effort to stabilize decentralized finance (DeFi) markets after a $292 million exploit left the sector's largest lender grappling with a large hole in collateral backing, according to coindesk.com.
The initiative, dubbed "DeFi United" and led by Aave service providers, is aimed at restoring the backing of rsETH, a yield-bearing derivative token of ether (ETH) at the center of the exploit.
Aave stated on X that multiple participants have already made indicative commitments to support the effort.
Lido Finance was the first to respond. Its ecosystem contributor, Lido Labs Foundation, proposed allocating up to 2,500 stETH, worth approximately $5.7 million at current prices, into a dedicated relief vehicle.
These funds are intended to reduce the shortfall in rsETH backing and help prevent forced liquidations across lending markets.
EtherFi followed with a proposal to contribute 5,000 ETH to protect users and prevent bad debt across the DeFi ecosystem.
Aave founder Stani Kulechov also offered a 5,000 ETH contribution to the cause.
"Aave is my life's work and we're working nonstop to find the best possible outcome for users," Kulechov said in an X post. "I’m working to see this resolved and market conditions normalized as soon as possible."
Aave stated it plans to announce more commitments once they are formalized.
The mechanics of the exploit
The incident traces back to an attacker exploiting a vulnerability in KelpDAO’s integration with LayerZero. The attacker used the bridge’s messaging system to mint 116,500 unbacked rsETH tokens.
Rather than dumping the tokens immediately, the attacker deposited nearly 90,000 rsETH into Aave as collateral. They used this to borrow roughly $190 million in ETH and other assets across the Ethereum and Arbitrum networks.
This left Aave with impaired collateral, which triggered a massive withdrawal wave from depositors. The total value of assets on Aave dropped by $10 billion following the incident.
Aave's incident report estimates the total hole exceeds 112,000 rsETH.
Some containment efforts occurred earlier this week when Arbitrum’s security council froze 30,766 ETH, valued at roughly $71 million at the time, which was tied to the exploit.
However, the remainder of the stolen funds were bridged and swapped into Bitcoin via Thorchain, complicating recovery efforts. The current "DeFi United" focus remains on stabilizing the system through a coordinated bailout to recapitalize rsETH.
