Aave Fully Reopens Ethereum Borrowing After $292 Million KelpDAO Exploit — DeFi’s Biggest Lender Signals Recovery

The April 18 exploit began when attackers manipulated KelpDAO's LayerZero bridge configuration, allowing them to mint approximately 112,103 rsETH tokens that had no real backing. These counterfeit tokens were immediately deposited into Aave as collateral, and the attackers borrowed roughly 230 million dollars in real ether against them before the scheme was detected. Because rsETH was widely used as collateral across DeFi, the fallout was immediate and severe: roughly 6.2 billion dollars drained from Aave in a single day as depositors rushed to exit, pushing wrapped ether pool utilization to 100 percent and trapping remaining depositors who could not withdraw until new liquidity arrived. Aave moved quickly to freeze wrapped ether loan-to-value ratios across Ethereum mainnet, Arbitrum, Base, Mantle, and Linea to prevent further damage.

The recovery effort was coordinated through an industry coalition called DeFi United, which brought together Aave's own service providers alongside Lido Finance, EtherFi, the Solana Foundation, and Aave founder Stani Kulechov, who contributed personal funds. The group worked to recover or replace the unbacked rsETH in the system through liquidations and direct ETH contributions. Of the 112,103 unbacked rsETH created in the exploit, 106,993 have now been recovered through Aave and Compound liquidations, leaving a residual shortfall of approximately 5,200 rsETH. DeFi United has committed to covering that remaining gap, allowing Aave to restore lending conditions. Wrapped ether now operates at pre-incident loan-to-value ratios across all six affected networks, including 80.5 percent on Ethereum Core and 84 percent on Ethereum Prime, meaning borrowers can once again use their Ethereum holdings as collateral at normal terms.

The technical recovery does not end all outstanding issues. A New York federal judge has delayed a decision on Aave's emergency motion to unfreeze 71 million dollars in ETH that was frozen by Arbitrum as part of the hack response, requesting additional information from both sides ahead of a new hearing scheduled for June 5. Questions around legal liability, who ultimately bears responsibility for the unbacked tokens that were created through the bridge exploit, and how the costs of the recovery should be allocated among the various parties in the DeFi United coalition remain subjects of active litigation. Despite those complications, the reopening of Ethereum borrowing is a meaningful signal for decentralized finance as a whole, demonstrating that coordinated industry responses can contain catastrophic exploits without requiring centralized intervention. Users interested in participating in DeFi lending and staking directly from their own wallets should explore the best DeFi wallets available, which allow secure interaction with protocols like Aave without counterparty risk.

The June 5 court hearing on the frozen ETH will be the next significant legal milestone. Aave's governance community is also expected to introduce new risk parameters for liquid restaking tokens following the exploit, with proposals already circulating to apply stricter collateral haircuts to bridge-dependent receipt tokens. The broader DeFi sector is watching closely: the KelpDAO incident is the largest proof-of-concept yet for coordinated industry recovery, and its ultimate legal resolution will shape how similar crises are handled in the future. Ethereum's price, which dropped sharply during the exploit panic, has since partially recovered, though broader macro pressure from rising U.S. Treasury yields and geopolitical concerns continues to weigh on the market.