$292M KelpDAO Exploit Exposes DeFi’s Liquidity Crisis, Triggers Cross-Chain Rescue

A $292 million exploit of KelpDAO’s rsETH token on April 18, 2026, triggered a cascading liquidity crisis across DeFi’s largest lending protocols, forcing Aave to deploy capital on Solana and mobilizing $240 million in coordinated recovery commitments. Attackers exploited a LayerZero bridge misconfiguration to mint 116,500 unbacked rsETH tokens, deposited them as collateral in Aave, and borrowed $292 million in ETH and stablecoins. Within hours, WETH utilization in Aave’s pools reached 100%, locking legitimate users out of withdrawals and triggering $12 billion in outflows across the protocol.

How the rsETH Bridge Vulnerability Unraveled DeFi Liquidity

The KelpDAO exploit exposed a critical infrastructure gap in cross-chain DeFi. Attackers leveraged a LayerZero bridge configuration weakness to generate unbacked rsETH—a liquid restaking token issued by KelpDAO—without corresponding collateral. These synthetic tokens were then deposited across Aave, Compound, and Euler, where they passed collateral checks and enabled massive borrows. The attack cascaded because Aave had integrated rsETH into its lending pools without detecting the bridge’s vulnerability. Once the exploit became public, mass withdrawals drained liquidity pools to full utilization, preventing redemptions. As Galaxy Research noted: “At full utilization, Aave’s design doesn’t allow withdrawals, because there is no idle liquidity in the pool to redeem against. Whoever withdraws first is made whole, while whoever comes later must wait for new supply to arrive or borrowers to repay.” This design constraint, rational during normal conditions, became a chokepoint during the crisis.

Solana Foundation Deploys Treasury as DeFi Contagion Spreads

The crisis spread beyond Ethereum. By April 25, the Solana Foundation announced USDT lending to Aave, signaling systemic concern about DeFi’s health across chains. Total DeFi value locked declined 17% in the month, with $13 billion in cumulative losses reported. Aave’s leadership position—commanding $25 billion in lending—meant its dysfunction created network effects. On April 25, less than a week after the exploit, AAVE token launched on Solana, positioning the protocol for expanded presence on the network. The Foundation’s intervention reflected a broader realization: cross-chain DeFi contagion threatens entire ecosystems. Lily Liu, Solana Foundation chair, stated: “blockchain economies do not operate in isolation and that Solana’s long-term health depends on a functioning DeFi sector beyond its own ecosystem.” This marked a departure from siloed blockchain strategies.

DeFi United Mobilizes $240M Recovery, Addresses Systemic Risk

The recovery effort, branded DeFi United, coordinated $240 million in commitments from Aave DAO, Arbitrum DAO, Mantle, Ether.fi, Lido, Kelp, and the Golem Foundation. While the recovery package falls short of the $292 million exploit amount, it signals unified action to stabilize lending pools and restore user confidence. The gap between recovery commitments and exploit size raises questions about whether additional mechanisms—liquidations, borrower repayment, or protocol-level haircuts—will bridge the shortfall. The crisis highlighted three systemic vulnerabilities: bridge infrastructure risks, the concentration of liquidity in flagship protocols like Aave, and the absence of circuit breakers during mass withdrawal events. DeFi’s largest lending venue now operates across multiple chains, but cross-chain coordination remains untested at scale.

Next Steps: Governance Decisions and Liquidity Restoration

Aave’s recovery on Solana depends on Solana Foundation USDT deployment and successful liquidation of collateral backing the exploit. Governance votes on protocol-level changes—such as collateral whitelisting rules or bridge integration standards—have not been detailed. The timeline for full liquidity restoration remains unclear, as does the repayment status of the $292 million borrowed assets. DeFi’s credibility hinges on transparent communication from Aave DAO and coordinated action from DeFi United participants over the next 30 days.