Who Is Behind DeFi United and How Seven Protocols Are Coordinating the Largest Bailout in DeFi History

Seven of the largest DeFi protocols have pooled roughly 69,534 ETH, worth approximately $161 million at current prices, into a single recovery fund called DeFi United. The goal is to restore full backing for rsETH, the liquid restaking token at the center of the April 18 KelpDAO exploit that drained $292 million from the protocol's LayerZero bridge adapter. Nothing like this has happened before in decentralized finance. Protocols that normally compete for TVL, users, and market share are now writing checks to save each other from contagion.

The coalition includes Aave, Lido, EtherFi, Ethena, Mantle, Ink Foundation, and BGD Labs, with individual contributions from Aave founder Stani Kulechov and VP of engineering Emilio Frangella. The fund still has a gap to close, and the outcome will set a precedent for how DeFi handles systemic crises going forward.

What Happened to Kelp DAO and Why It Triggered a DeFi-Wide Response

On April 18, 2026, attackers linked to North Korea's Lazarus Group exploited a vulnerability in KelpDAO's integration with LayerZero's cross-chain messaging system. The attack was not a smart contract hack in the traditional sense. The attackers compromised two of LayerZero's verification servers and flooded backup servers with junk traffic, forcing the system onto compromised nodes. This allowed them to mint 116,500 unbacked rsETH tokens by tricking the bridge into believing a valid cross-chain instruction had arrived.

The critical design flaw was that rsETH used a single verifier, the LayerZero Labs DVN, with no second verifier required to confirm transactions. A 1-of-1 verification setup on a bridge handling hundreds of millions in value.

Instead of selling the stolen rsETH on the open market, the attacker deposited nearly 90,000 rsETH into Aave V3 as collateral and borrowed approximately $190 million in WETH and other assets across Ethereum and Arbitrum. Because the rsETH collateral was unbacked, Aave was suddenly sitting on roughly $196 million in bad debt. The total value locked across Aave dropped $6.6 billion as users panic-withdrew from every market on the platform.

DeFi's total TVL fell from roughly $99 billion to $85 billion between April 18 and April 20, the sharpest two-day decline in over a year. That contagion risk is what forced competing protocols to coordinate instead of watching from the sidelines.

Who Are the Seven Protocols in DeFi United

The coalition is led by Aave's service providers and includes protocols that span lending, liquid staking, stablecoins, and Layer-2 infrastructure. Each member has a different reason to participate, and each brings different resources to the table.

Aave (25,000 ETH proposed). As the largest lending protocol in DeFi, Aave absorbed the worst of the damage. The Aave DAO governance proposal published by TokenLogic asks token holders to approve a 25,000 ETH contribution from the DAO treasury. This would make Aave the single largest contributor to the fund. Founder Stani Kulechov personally pledged 5,000 ETH, and Emilio Frangella committed 500 ETH from his own holdings.

Mantle (up to 30,000 ETH credit facility). Mantle proposed a structured loan from its treasury rather than an outright donation. The credit facility of up to 30,000 ETH would help Aave absorb remaining bad debt at low interest, giving the protocol breathing room to recover without forced token dilution.

EtherFi (5,000 ETH). As a liquid restaking protocol that directly competes with Kelp in the same market, EtherFi's participation signals that the restaking sector sees this as a shared infrastructure problem rather than a competitor's failure.

Lido (2,500 stETH). Lido DAO advanced a proposal to contribute up to 2,500 stETH, worth approximately $5.8 million. As the dominant liquid staking protocol with over $14 billion in TVL, Lido's contribution is smaller in absolute terms but significant symbolically. It signals that even protocols not directly affected consider the rsETH shortfall a systemic risk worth addressing.

Ethena, Ink Foundation, and BGD Labs. Ethena joined the coordinated effort as a stablecoin protocol with exposure to ETH-based collateral. Ink Foundation (also listed alongside Tydro) and BGD Labs, which contributed 250 ETH, round out the core coalition. Additional contributors include Golem Foundation (1,000 ETH) and several individual backers.

How the Recovery Math Works

The original shortfall from the exploit is approximately 163,183 ETH. Not all of that needs to come from DeFi United. Several recovery channels are running in parallel.

The DeFi United fund totals roughly 69,534 ETH in pledged and proposed contributions. Combined with the Arbitrum freeze and KelpDAO's own recovery of 73,700 ETH, the remaining gap has narrowed significantly. A community tracker estimated the total rsETH hole at approximately 118,400 ETH and showed the gap effectively covered once all pledges and recoveries are factored in.

The math works only if every pledge converts to actual capital. Governance votes at Aave and Lido still need to pass, and Mantle's credit facility terms need finalization. But the trajectory suggests the shortfall will be fully covered.

Why This Has Never Happened Before in DeFi

DeFi has seen massive exploits before. The Ronin Bridge hack in 2022 cost $625 million. The Wormhole exploit cost $320 million. But in every previous case, the response was isolated. The affected protocol either absorbed the loss, a single backer (like Jump Crypto covering Wormhole) stepped in, or users simply took the hit.

DeFi United is structurally different because seven competing protocols are coordinating a shared financial response. Aave and EtherFi and Lido are not natural allies. They compete for users, for TVL, and for governance influence. The fact that they are pooling capital into a joint fund suggests that DeFi's interconnected risk is now too large for any single protocol to absorb alone.

The closest parallel in traditional finance is the 2008 TARP bailout, where the U.S. government committed $443.5 billion to stabilize failing banks, but the differences between TARP and DeFi United are instructive. TARP was taxpayer-funded, government-directed, and took months to pass through Congress. DeFi United is voluntary, industry-funded, and was organized within days of the exploit. No central authority forced anyone to participate. The protocols chose to act because contagion threatened all of them simultaneously.

And that voluntary aspect is what makes it fragile. TARP had the force of law. DeFi United runs on governance votes and good faith. If Aave's token holders reject the 25,000 ETH proposal, the entire recovery calculus changes.

What DeFi United Means for the Future of Decentralized Finance

The coalition sets three precedents that will outlast the Kelp recovery itself.

The first is that DeFi protocols now have an informal mutual defense expectation. Any future exploit affecting shared infrastructure will carry an implicit assumption that the ecosystem should coordinate a response. That expectation did not exist before April 2026.

The second is that protocol treasuries are now de facto insurance reserves. Aave's proposal to deploy 25,000 ETH from its treasury fundamentally redefines what DAO treasuries are for. They are no longer simply runway for development teams. They are backstops for systemic risk. Every protocol holding significant treasury assets will face the question of contributing to future recovery efforts, and token holders will price that obligation into governance tokens.

The third precedent is the most uncomfortable one. DeFi United worked because the affected protocols were large enough and well-capitalized enough to absorb the hit. A similar exploit affecting smaller protocols with thinner treasuries would not produce the same coordinated response. The bailout infrastructure that DeFi United creates is implicitly reserved for protocols that are "too big to fail," which is exactly the dynamic that DeFi was supposed to eliminate.

Frequently Asked Questions

What is DeFi United?

DeFi United is a coalition of seven major DeFi protocols and individual contributors coordinating a recovery fund to restore the backing of rsETH after the $292 million KelpDAO exploit on April 18, 2026. The fund has accumulated roughly 69,534 ETH in pledges from Aave, Lido, EtherFi, Ethena, Mantle, Ink Foundation, and BGD Labs, along with personal contributions from Aave executives.

How much ETH does DeFi United need to raise?

The original rsETH shortfall was approximately 163,183 ETH. After KelpDAO recovered 73,700 ETH directly and Arbitrum's security council froze 30,766 ETH tied to the attacker, the remaining gap narrowed to roughly 89,500 ETH. DeFi United contributions and pending governance proposals are on track to cover the remainder.

Is this the first DeFi bailout?

Individual protocols have covered exploit losses before, most notably Jump Crypto backstopping the $320 million Wormhole hack in 2022. But DeFi United is the first coordinated, multi-protocol recovery effort in the industry's history, with seven competing protocols pooling capital into a shared fund.

Who hacked Kelp DAO?

The attack has been attributed to North Korea's Lazarus Group. The hackers exploited KelpDAO's LayerZero bridge integration by compromising verification servers and forcing the system onto compromised nodes, allowing them to mint 116,500 unbacked rsETH tokens worth $292 million.

Bottom Line

DeFi United is the first time the decentralized finance industry has organized a collective bailout, and the fact that it happened within days rather than months tells you something about how interconnected the ecosystem has become. The fund stands at 69,534 ETH with Aave's 25,000 ETH governance vote still pending. If that vote passes, the rsETH shortfall is effectively covered and DeFi avoids what could have become a cascading liquidation crisis across every lending market that accepted liquid restaking tokens as collateral.

But the harder question comes after the recovery. Every protocol with a large treasury now knows it could be asked to participate in the next bailout. Every governance token holder now prices that risk into their positions. And every restaking protocol now operates under the knowledge that a single-verifier bridge configuration created a $292 million hole that took seven protocols and tens of thousands of ETH to fill. DeFi United proved that the industry can coordinate under pressure, but the question of how that coordination ages over time depends entirely on what happens the next time a bridge gets exploited.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency trading involves substantial risk. Always conduct your own research before making trading decisions.