BroadChain, April 25, 21:02 - The core logic of DeFi is code-managed assets; once something goes wrong, users have no recourse. Now, the largest lending protocol, Aave, is organizing the entire industry to raise funds to fill the gap. Early on April 23, Aave founder Stani Kulechov announced a contribution of 5,000 ETH (approximately $11.5 million) to the "DeFi United" fund to cover the vulnerability. Six days ago, hackers exploited a cross-chain bridge vulnerability in KelpDAO to mint fake tokens out of thin air, collateralizing them on Aave and borrowing nearly $200 million worth of ETH.
Aave manages over $30 billion in user assets. After the incident was exposed, large holders and institutions were the first to withdraw, with deposits evaporating by nearly $15 billion within six days, draining the core liquidity pool. Depositors who have not withdrawn are now unable to access their funds. According to CoinDesk, the utilization rate of USDT and USDC liquidity pools once approached 100%. Stani referred to Aave as his "life's work," hinting at the severity of the situation.
DeFi United is essentially an industry bailout mechanism. Currently, publicly committed contributors include Lido, EtherFi, the Golem Foundation, and Bybit's Mantle. However, funds have not yet been fully secured: Stani has contributed 5,000 ETH, and the Golem Foundation has contributed 1,000 ETH; proposals for Lido's 2,500 stETH and EtherFi's 5,000 ETH are still undergoing DAO voting; Mantle's loan of 30,000 ETH is still being planned in the governance forum. Lido has also attached a condition: funds will only be released once a complete recovery plan is finalized.
How big is the KelpDAO vulnerability? The hacker borrowed approximately 99,600 ETH in total, with the Arbitrum Security Council freezing 30,700 ETH, leaving a gap of about 68,900 ETH (approximately $160 million). The five potential supporters could provide around 43,500 ETH, with 25,000 ETH still unclaimed. This is akin to a DeFi version of the "Troubled Asset Relief Program."
If Aave's bad debts are not resolved, the consequences will spread across the entire DeFi ecosystem. The rsETH token is used as collateral by multiple protocols, with Aave holding 83% of its circulating supply. Once it de-pegs, the bad debt will infect all protocols that accept rsETH. Lido's proposal notes that users of the EarnETH yield vault alone could face forced liquidation losses of up to 9,000 ETH. Competitors are injecting funds not out of goodwill but for self-preservation—the contagion of the financial system dictates that when an institution deemed "too big to fail" runs into trouble, everyone has to pay the price.