The DeFi Rescue Team has finally arrived.
On April 24, the Ethereum mining marketplace Golem announced a transfer of 1,000 ETH from two treasuries to participate in Aave-led rsETH joint rescue. Earlier, the liquidity re-collateralization protocol EtherFi proposed to inject 5,000 ETH into a special rescue pool, and the liquidity staking leader Lido Finance posted a proposal on the governance forum to provide up to 2,500 stETH.
Together with Aave founder Stani Kulechov's personal commitment of 5,000 ETH, this self-proclaimed "DeFi United" joint rescue operation, with the disclosed funding scale, stands at 13,500 ETH plus 2,500 stETH.
This series of contributions stemmed from the KelpDAO hack a week ago. According to LayerZero's official attribution, a sub-branch of the North Korean hacker group Lazarus called TraderTraitor breached LayerZero DVN's downstream RPC node on April 18, spoofed cross-chain messages, and stole 116,500 rsETH from the KelpDAO's 1/1 DVN bridge contract, worth around $292 million, accounting for approximately 18% of the rsETH circulating supply.
Recommended Reading: "$290 Million Stolen, Three Parties in Dispute, Who Should Bear the Loss in the KelpDAO Incident?"
How Much Did Each Party Donate?
If you put the commitments of the four parties together in one chart, you'll find that the pledged amounts actually vary significantly. Stani and the EtherFi Foundation were the most straightforward, each withdrawing 5,000 ETH directly from their respective treasuries, with no conditions attached. Golem's 1,000 ETH came from a combined disbursement from the Foundation and Factory treasuries, and according to their statement, the funds have been aligned with the Aave team's usage path.
The situation with Lido's 2,500 stETH is slightly more complex. This is a governance proposal and comes with a precondition of "full funding coverage upon the completion of the overall rescue plan," which means this money from Lido will only be released once other participants fill the gap. The four commitments, converted at an ETH spot price of $2,400 at the time of the incident, amount to approximately $38.4 million.
The question is what this number should be compared to. According to the Aave official incident report, the estimated range for the bad debt is between $124 million and $230 million. Just looking at the lower bound, $38.4 million is just over 30% of the shortfall.
However, the $38.4 million from DeFi United is not the only layer of buffer for Aave. On April 21, the Arbitrum Security Council, without having possession of the hacker's private key, performed a temporary upgrade to the Inbox bridge contract in the hacker's name, sending all 30,766 ETH from the hacker's address to a frozen address, worth approximately $71.5 million.
The ETH was originally the real WETH borrowed by the attacker from the Aave Arbitrum market. If it is later returned according to an Aave governance proposal, it will directly burn 36,166.8 corresponding rsETH collateral. According to the Aave governance forum's calculation, the total unbacked rsETH will decrease from 112,204 to 76,037, and the detachment ratio will drop from 15.12% to 10.77%.
Recommended reading: "Arbitrum Pretends to Be the Hacker and 'Steals' Back the Money Lost by KelpDAO"
The third layer is Aave's own Umbrella Insurance Pool. According to the LlamaRisk incident report, the WETH Umbrella module in the Ethereum Core currently has a collateral size of 23,507.63 WETH, valued at approximately $54.06 million at the time of the incident. This is the new generation insurance mechanism that Aave rolled out at the end of 2025, replacing the original Safety Module. Its initial design was to automatically slash before the bad debt actually hits the depositors.
The total of the three layers is $163 million. Compared to the lower scenario of $124 million, the pit is just filled and there is a surplus of $39.8 million. Compared to the higher scenario of $230 million, there is still a shortfall of $66.6 million.
The same attack, why did Aave simulate two scenarios with a difference of nearly $100 million?
The key question of "who bears the loss of the 112,204 arbitrarily minted rsETH" itself does not have a single answer. Aave's risk management service provider, LlamaRisk, laid out two options in the incident report released on April 20.
The first option is the "pro-rata route." All rsETH holders share the loss based on the current supply, calculated using the formula depeg = unbacked / (original supply + unbacked), resulting in a uniform devaluation rate of 15.12%.
In this scenario, Aave's default is mainly concentrated in the Ethereum Core market. According to LlamaRisk's calculations, its WETH market will absorb a $91.8 million default, while L2 solutions like Arbitrum, Base, Linea, and Mantle will collectively absorb around $31.9 million, totaling $124 million. The most severely affected L2 is Mantle, as it has the smallest WETH reserve and needs to take on a 9.54% reserve gap proportionally, although the absolute amount is not significant.
The second option is the "isolation route." Assuming the mainnet rsETH collateral is intact, all losses are isolated to the L2 mapped version of rsETH. After all, the hacker took the original mainnet vouchers from the LayerZero bridge, and logically, the L2 rsETH that has already "crossed the chain" no longer has collateral.
Under the isolation route, the devaluation rate of L2 rsETH directly jumps to 73.54%, with Ethereum Core intact. However, Mantle's WETH market will experience a 71.45% reserve gap ($77 million), Arbitrum follows with 26.67% ($88.4 million), and other L2 solutions combine for $64 million, totaling $230 million.
Considering the $106 million difference in Aave's default under the two routes, it essentially signifies a transfer of "who bears the cost." According to discussions on the Aave governance forum, choosing pro-rata means Ethereum Core depositors must collectively bear a $91.8 million loss. Opting for isolation completely protects the mainnet, but most of the WETH depositors on Mantle and Arbitrum's L2 need to bear the brunt.
Aave is currently leaning heavily towards the latter. In an update statement on April 20, the team emphasized that "rsETH on the Ethereum mainnet is well-collateralized." According to the LlamaRisk report, the ultimate path forward will depend on how KelpDAO updates rsETH's LRT oracle price and the cross-chain accounting caliber, which is "outside of Aave's control."
Can I Withdraw My Money Yet?
Returning to the question that readers are most concerned about—can I withdraw the money I have in Aave after this rescue operation? The answer is, the $38.4 million from DeFi United is not a "compensation fund" distributed to Aave depositors. The rescue pool's funds will be injected into Kelp's rsETH collateral to restore the pegged price of rsETH. As long as rsETH has fair value, Aave can liquidate the attacker's 89,567 collateral positions, liquidating proceeds to repay the 82,650 WETH borrowed. The WETH pool utilization rate will start to drop from 100%, allowing depositors to resume withdrawals.
According to the Aave Incident Report, the WETH reserves on five chains—Ethereum, Arbitrum, Base, Linea, and Mantle—are currently fully utilized, with idle WETH balances on each chain below $20. This is why ordinary depositors are seeing "withdrawal failed" at the moment. It's not because the protocol has exit scammed; it's because all the money has been lent out, with the hacker as the borrower, and repayment will have to await the resurgence of rsETH collateral.
Another path in case of insufficient rescue funds is the Umbrella waterfall. According to the Aave Umbrella documentation, the triggering sequence starts with automatic slashing of aWETH Umbrella stakers, then moves on to a proportional haircut for regular WETH depositors, followed by stkAAVE holders (requiring governance vote activation), and lastly, the DAO treasury as the backstop. At the level of individual depositors, the outcomes fall into two scenarios.
If the equalization route is ultimately taken, the worst-case scenario of $12.4 million bad debt will mainly weigh on the Ethereum Core with $91.8 million. The 71.5 million ETH frozen on Arbitrum could directly offset a significant portion of L2 debts, together with a $54.06 million Umbrella reserve, in addition to the $38.4 million external infusion from DeFi United. With such well-fortified defenses, Ethereum Mainnet and various L2 WETH depositors will most likely be able to recover their full principal.
If the final path chosen is isolation, the situation will bifurcate. Ethereum Core remains fully intact, with the mainnet depositors unaffected. However, Umbrella will not be triggered either, as per the Aave Incident Report, its coverage only extends to Ethereum Core. The WETH depositors on Mantle and Arbitrum, who are truly facing a $230 million loss, can only count on the $71.5 million freeze on Arbitrum, along with the $38.4 million external injection from DeFi United, totaling approximately $109 million.
Compared to the combined default of $166 million on these two chains (Mantle $77.7 million plus Arbitrum $88.4 million), there is still a shortfall of $57 million. This gap may eventually follow the downstream path, proportionally affecting the WETH depositors on Mantle and Arbitrum.
With DeFi United's $38.4 million, Aave's own hoarded $54.06 million in Umbrella, and the 71.5 million ETH recovered by Arbitrum in its role as the "savior from the hacker," a total of $163 million has been raised, just enough to cover the low-case default scenario provided by Aave. The remaining part will depend on which recovery path KelpDAO chooses, focusing on saving assets, and it won't be known until one or two weeks later whose principal will be affected.
