On April 18, 2026, attackers used Kelp DAO's bridge to generate unbacked rsETH and access Aave for large loans, causing a high-impact flaw that shook DeFi. In a matter of hours, withdrawals skyrocketed and market liquidity crisis spread. However, the ecosystem moved quickly, freezing risk, tracking assets, and organising a unique, extensive financial backstop, instead of spiralling. What followed was not only damage control but also a test of DeFi's ability to defend itself as a group in real time.

• How the Kelp DAO Exploit Unfolded?
• Aave's Emergency Response Across 11 Chains
• Arbritum Steps In & Tracks the Laundering Trails
• 'Defi United': A Coordinated Financial Backstop

How the Kelp DAO Exploit Unfolded?

The attack started because of a serious flaw in the bridge infrastructure of Kelp DAO. 116,500 rsETH tokens were successfully minted by exploiters without any underlying collateral. The real impact came from what they did next, moving those tokens into Aave, rather than just that.

After it was placed, the attacker used the inflated collateral to borrow assets valued at about $191 million. This was not a gradual drain; rather, it caused instantaneous liquidity stress in several pools. The exploit's scope and speed led to widespread fear, which prompted customers to take money out quickly.

As it became evident that Aave was exposed, the situation worsened. The protocol encountered an abrupt imbalance, massive borrowing backed by virtually worthless collateral, because rsETH was seen as a legitimate asset in lending markets.

Aave's Emergency Response Across 11 Chains

Aave took swift and effective action to limit the harm. By effectively halting additional borrowing and restricting the attacker's ability to take more value, the protocol froze markets across 11 distinct blockchain networks.

This was a defensive system-wide action rather than a standard pause. The objective was easy, i.e., stop the bleeding before it began. Cross-chain market freezing demonstrated how linked DeFi has grown and how a single attack may have a cascading effect on entire ecosystems.

Aave's risk factors were reevaluated in real time concurrently. As withdrawals increased, liquidity conditions were keenly observed. Deposits stabilised at $28.6 billion despite the upheaval, indicating that the intervention averted a complete collapse.

Aave is my life's work and we're working nonstop to find the best possible outcome for users.

I’m personally contributing 5000 ETH to DeFi United as we continue working together with partners on formalizing more commitments. I’m working to see this resolved and market conditions…

— Stani (@StaniKulechov) April 23, 2026

Arbritum Steps In & Tracks the Laundering Trails

Arbitrum Security Council's successful seizure of $71 million associated with the exploiter was one of the most noteworthy initiatives. This was a unique situation in which governing structures took immediate action to retrieve money.

In the meantime, the attacker tried to use intricate laundering techniques to hide the pilfered assets. Money was transferred between several ecosystems, such as Thorchain and Bitcoin. In addition to making monitoring more challenging, these motions prompted grave concerns.

There were hints that some of the money might be connected to the infamous Lazarus Group, which is well-known for its extensive cryptocurrency exploits. The pattern of asset mixing and cross-chain laundering is very similar to earlier cases connected to the gang, even though attribution is still unclear.

The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…

— Arbitrum (@arbitrum) April 21, 2026

'Defi United': A Coordinated Financial Backstop

The reaction that followed was what really marked this incident. Major players responded to the shock and safeguarded consumers under an unofficial campaign known as "DeFi United."

To aid in the recovery process, Stani Kulechov personally pledged 5,000 ETH. Ether.fi suggested contributing an additional 5,000 ETH with him. The pool now has 2,500 stETH thanks to Lido.

A total of more than 43,000 ETH was promised to cover the projected $258 million deficit. This was a practical financial safety net intended to rebuild solvency and user confidence, not just a symbol.

As we continue our efforts towards restoring rsETH's backing, @ether_fi has also stepped up to contribute and published a proposal to their DAO.

EtherFi has been a great partner to the Aave ecosystem and we look forward to our continued collaboration with them.

DeFi United. https://t.co/O6ECQ2DhJ5

— Aave (@aave) April 23, 2026

The synchronised response brought to light something rare at this scale: real-time collaboration between opposing protocols. They absorbed risk as a group to stabilise the larger ecosystem rather than separating themselves.

This instance showed that DeFi is more than just a collection of separate protocols; when necessary, it can operate as a cooperative network. Many critics were surprised by the level of maturity demonstrated by the quick financial mobilisation and incentive alignment.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Volo Protocol Confirms $3.5M Exploit, Assures Full Coverage
2. EtherFi Migrates to OP Mainnet With $220M TVL
3. Tether Mints $1B on Ethereum Network
4. Gnosis & Zisk Launch Ethereum Economic Zone
5. Rhea Finance Exploit Drains $7.6M

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.