DeFi lost $13B this month as the KelpDAO rescue shows both the best and worst of DeFi

The official DeFi United site shows over 69,550 ETH raised from 222 wallets across 1,623 transfers, all aimed at restoring rsETH backing, acting as DeFi’s emergency recapitalization desk.

The effort is the closest thing the industry has built to a lender of last resort, assembled without a regulator, a central bank, or a mandate.

Aave’s governance proposal puts the original rsETH shortfall at approximately 163,183 ETH.

Recoveries and freezes, which include 43,168 ETH from Kelp, 30,766 ETH frozen by the Arbitrum Security Council, up to 12,323 WETH from Aave liquidations, and 1,845 WETH from Compound, reduce the residual funding gap to about 75,081 ETH.

DeFi United’s current top line covers roughly 92.5% of that residual, leaving approximately 5,632 ETH. A broader tracker snapshot shows 100,200 ETH committed against a 116,500 ETH target when the Arbitrum frozen recovery path is included, putting total coverage at about 86%.

Both numbers carry the same caveat that the fund is close on paper, while most of the largest pieces are still pending governance votes, and several key contributions carry no disclosed amount.

How the hole got this large

KelpDAO’s rsETH bridge ran a 1-of-1 configuration with LayerZero Labs as the sole verifier.

Galaxy’s research found that the attacker exploited that setup to unlock 116,500 rsETH from Ethereum mainnet escrow, then used the stolen tokens as collateral across Aave, Compound, and Euler to borrow an estimated $236 million in WETH and wstETH.

Within 48 hours, DeFi’s total value locked fell by roughly $13 billion. Aave alone shed about $8.45 billion in TVL, with WETH utilization hitting 100% as users rushed for the exits, simultaneously pushing USDT and USDC pools to full utilization.

LayerZero’s own incident statement characterized the attack as RPC poisoning targeting infrastructure used by its decentralized validator network (DVN), stopping short of identifying a flaw in the LayerZero protocol itself.

The bridge route still depended on LayerZero Labs as the sole verifier, a configuration that concentrated trust in a single point. DeFi United lists LayerZero as “Confirmed, TBD.”

Because the entire incident ran through that bridge configuration, LayerZero’s undisclosed contribution is one of the most consequential missing numbers in the recovery.

The coordination case

DeFi United assembled without a regulatory mandate, a central bank, or an order from anyone.

Before Aave’s treasury proposal even entered governance, EtherFi, Lido, Mantle, Ethena, Ink, BGD Labs, Emilio Frangella, Ernesto, and Aave’s founder Stani Kulechov had already assembled 14,570 ETH in pledges.

The fund’s named contributors now include Mantle with 30,000 ETH pending vote, Aave DAO with 25,000 ETH pending vote, Kulechov personally committing 5,000 ETH, EtherFi at 5,000 ETH pending vote, Lido at 2,500 ETH pending vote, Golem Foundation at 1,000 ETH, Frangella at 500 ETH, and BGD Labs plus Ernesto at 350 ETH.

LayerZero, Ethena, Ink Foundation, and Frax Finance are confirmed, with amounts still undisclosed.

Aave’s ARFC frames its participation under a “No Ghost Left Behind” posture, citing the DAO’s prior decision to cover CRV-related bad debt directly, shielding suppliers from socialized losses.

That framing of voluntary, cross-protocol, and publicly visible is the strongest argument the industry can make for its own self-governance capacity.

The centralization embedded in the rescue

Aave’s proposal authorizes Aave Labs to negotiate loans, settlements, indemnities, under-collateralized lending arrangements, warrants, token sales, and deployment of future protocol revenue.

The Mantle contribution is structured as a credit facility, with later donations earmarked to repay Mantle, leaving Aave’s treasury ask unchanged.

Aave’s math treats the Arbitrum Security Council’s 30,766 ETH as a recoverable stream that requires further governance action to release and sits outside DeFi United’s control, as the site explicitly acknowledges. The same applies to KelpDAO reopening withdrawals and LayerZero reopening the bridge.

The Arbitrum intervention cuts to the center of the decentralization contradiction. A security council with emergency powers froze tens of thousands of ETH linked to the exploit and moved it into a controlled intermediary wallet.

That action helped contain the damage, and also required someone with the power to say no and to use it unilaterally in a crisis. In a system built around credible neutrality, the freeze both saved and complicated the narrative.

What governance is actually debating

Aave’s forum has already produced the backlash the situation invites. One commenter argues the recovery math is sound but says the DAO should not move to a Snapshot vote until governance adopts a collateral-risk framework that would have blocked rsETH from being listed at those parameters.

Paying the bill without fixing the kitchen solves the immediate crisis and creates conditions for the next one.

Another voice in the same thread argues that the parties most responsible for the configuration are contributing proportionally less than the burden they impose on Aave.

Lido’s parallel forum debate sharpens the question of precedent. Its proposal authorizes up to 2,500 stETH but only as part of a fully funded recovery package, with Lido noting that the alternative could expose its EarnETH vault to roughly 9,000 ETH in losses.

Delegates are openly debating if the contribution is a donation, if it should carry better terms, and if participation sets a precedent for covering losses originating outside Lido’s own protocol.

Two paths forward

In the bull case, the pending governance votes clear quickly, Kelp and bridge-side mechanics reopen in an orderly sequence, Arbitrum governance releases the frozen ETH, and the remaining TBD participants close the gap.

The recovery becomes a working model for cross-protocol crisis coordination, proof that DeFi can self-insure without external backstops, and that the governance layer functions even when composability fails at the infrastructure level.

The backlash about collateral risk reform gets folded into the next governance cycle, leaving the rescue intact.

In the bear case, one or more of the largest pending votes or external recovery steps slip. The Arbitrum freeze stays politically contested.

LayerZero’s contribution, once disclosed, falls short of what the bridge’s structural role in the incident warrants. Aave’s balance sheet absorbs more of the residual for longer than the proposal anticipates, and the governance backlash hardens around who decided that a 1-of-1 bridge-backed token qualified as acceptable collateral at those parameters.

DeFi United still exists in this version, but it becomes the case study in how the industry coordinates around downside on terms set by the largest actors.

DeFi United may close the gap, restore rsETH backing, and demonstrate that decentralized protocols can absorb a nine-figure exploit without systemic collapse. The recovery effort so far gives genuine grounds for that conclusion.

The rescue’s architecture of pending votes, a private credit facility, a security council’s freeze button, undisclosed negotiations, and legal instruments authorized by a DAO also describes a financial system that runs on credible neutrality until the losses are large enough, and then runs on whoever has the keys.