Last week we titled “Will Aave Win?“. Seven days later, your entry price into the thesis has gotten a lot cheaper.

We won’t spoil much because we dedicate today’s top story to the KelpDAO exploit, one of the biggest crises in DeFi history.

But while trust has once again taken a big hit, there’s an advantage to DeFi bank runs happening in public and in real time. Everybody can study what went wrong.

And if there’s a silver lining, it’s two things.

First, the industry has learnt more in the last six days than in the past two years. Lending markets will get stricter on collateral. Risk frameworks will tighten across the stack. The shift toward more modular, isolated lending architectures will accelerate. The protocols that survive this will harden.

Second, in DeFi you don't just get to witness the crisis in real time. Sometimes you also get to watch the industry bail out its own users, without a single taxpayer stepping in. That's what's happening with Aave right now.

Taken together, it most likely means that DeFi will still win.

Exploit: Late Saturday night, the DeFi ecosystem was hit by another major exploit. By compromising the infrastructure of the cross-chain protocol LayerZero, an attacker minted 116,000 unbacked rsETH tokens from the restaking protocol KelpDAO. Rather than selling them on a decentralized exchange, which would have crashed the price and limited the payout, the attacker deposited them as collateral on Aave and borrowed ~$190 million in ETH against them. Five days later, a coordinated industry effort has already closed around 80% of the resulting shortfall.

How it happened: This time, the weak point was the configuration of KelpDAO’s cross-chain bridge, which is used to move its restaking token rsETH across chains. Through a sophisticated attack, the attacker submitted a forged message to the bridge, releasing around 116,000 rsETH (~18% of circulating supply) on Ethereum without burning any corresponding tokens on the source chain.

Immediate response: To limit contagion, Aave froze its rsETH and ETH markets across all chains and disabled new deposits and borrows for these assets. This effectively locked user funds in the protocol, some of which remain frozen pending a resolution. To protect leveraged ETH positions and avoid excessive losses, the protocol also artificially lowered interest rates.

Liquidity crunch: But the freezes weren't enough to prevent what followed. In Aave V3, all lenders supply into a shared liquidity pool, from which any borrower can draw regardless of the collateral they post. As news of the exploit spread, this design set off the following dynamic:

Trapped depositors: As of today, roughly $8 billion in Aave positions across ETH, USDC, and USDT are effectively trapped in the protocol, including funds from lenders who never had any connection to rsETH.

Arbitrum intervenes: The first step towards recovery came from an unexpected direction. A significant portion of the stolen rsETH had been deposited on Aave’s Arbitrum market, where the attacker borrowed additional ETH. On Monday night, Arbitrum’s Security Council invoked its emergency powers for the first time in the Layer-2's history, freezing roughly 30,000 ETH (~$70 million) linked to the attacker.

Blame games: While much of the industry agreed with Arbitrum’s decision, views diverged sharply on who should bear primary responsibility for the actual attack:

Ripple effects: This misstep may have contributed to one of the largest capital flights in Aave’s history. Since the attack, the leading DeFi lending platform has seen around $12 billion in outflows, or roughly 46% of its TVL. While other major lending protocols such as Morpho were also marginally affected — despite having limited direct exposure to rsETH — one protocol stood out by attracting fresh inflows: Spark. Over the past few days, the protocol attracted $1.2 billion in deposits, 40% of which can be attributed to capital that left Aave.

A safe haven? One explanation lies in how Spark managed the market stress. Beyond having no exposure to rsETH, the protocol demonstrated stronger liquidity management, continuing to provide stablecoin liquidity while others faced constraints.

What’s next: Yesterday, leading DeFi and DAOs protocols launched "DeFi United," a coordinated effort to restore rsETH's backing and prevent losses for depositors. The shortfall stands at roughly 118,400 ETH. Within 48 hours, contributions from Mantle (30,000 ETH), Ether.fi (5,000 ETH), Aave founder Stani Kulechov personally (5,000 ETH), Lido (2,500 stETH), and others, combined with the Arbitrum freeze and recovered collateral, have narrowed the gap to an estimated 23,600 ETH. It is the largest coordinated rescue effort in DeFi history, and it is not done yet.