Nuclear-grade vulnerability: $290 million evaporated, Aave leads the rescue, retail investors' coffin lid can't be held down anymore?

Bro, sit tight. Today I’ll tell you a story, a story about $290 million, hackers, and a group of top protocols at the poker table exchanging chips.

The incident happened on April 18th, when Kelp DAO’s $rsETH cross-chain bridge was hacked. 116.5k $rsETH, valued at $292 million at the time, was minted without authorization by the hacker. This isn’t petty theft; it’s like blowing open the vault walls.

After getting the money, the hacker didn’t sit idle. He immediately went to Aave V3, used the artificially created $rsETH as collateral, and borrowed about $190 million worth of assets. Then, the Arbitrum Security Council took action, directly freezing 30,766 $ETH on-chain, temporarily hitting the brakes.

The real interesting part begins now.

As one of the largest victim platforms, Aave chose not to tough it out alone but led a joint rescue mechanism called “DeFi United.” The goal was clear: fill the total gap of 112.2k $rsETH (about $258 million). By April 24th, six days after the incident, this alliance had received about $100 million in tentative commitments.

But don’t get too excited yet. Most of these commitments are still in DAO voting and forum discussion stages. Actual funds are still a ways off.

Let’s look at what’s already decided. Golem Foundation and Golem Factory withdrew 1,000 $ETH from the treasury (about $2.3 million). Aave founder Stani Kulechov personally pledged 5,000 $ETH (about $11.5 million), saying Aave is his lifelong career, so he’s stepping up first. EtherFi Foundation authorized up to 5,000 $ETH (about $11.5 million), with a condition: the rescue completes, the cap is reached, or governance votes to end, then the program stops, and unused funds are returned.

Lido DAO’s proposal was the smartest. They agreed to contribute no more than 2,500 $stETH (about $5.75 million), but only if the rescue fund is fully subscribed and can cover the entire gap. If only part is covered, Lido won’t participate. Their reasoning was firm: if only part is filled, their EarnETH reserves still face a maximum loss of 9,000 $ETH. So, it’s all or nothing.

Mantle’s proposal was more like a shrewd business move. They suggested that Mantle Treasury lend up to 30k $ETH (about $69 million) to Aave DAO. Interest would be calculated as LIDO yield + 1%, with a maximum of 36 months, and early repayment without penalty. But Aave DAO must provide collateral of at least $11 million in $AAVE tokens plus future 5% protocol revenue, and delegate voting rights for 130k $AAVE to Mantle. Mantle sees this as a fixed-income tool during a crisis and also hopes to promote native deployment of Aave on Mantle.

Others like Ethena, LayerZero, INK Foundation have also expressed support, but amounts are not specified yet.

Doing the math: based on current tentative commitments, the remaining gap is roughly $50 million. Even if external commitments stop here, can Aave handle it alone?

Yes. Aave’s treasury holds about $180 million in assets, and the Umbrella security module has about $56 million in insurance funds. Combined, that’s $236 million, covering the upper range of the $123.7 million to $230.1 million bad debt estimate from LlamaRisk. So, Aave’s reserves are solid.

Market sentiment has also stabilized. Aave has partially unfreezed the previously emergency-frozen $WETH market, easing the initial $300 million lending squeeze. After dropping over 25% early on, $AAVE tokens are starting to stabilize.

But don’t think it’s over. The real danger lies in the details.

Spark’s strategy lead, @monetsupply.eth, publicly criticized Aave’s decision to unfreeze the $WETH market. He argued it was poorly considered, mainly benefiting cyclic loan arbitrageurs. Because Aave’s core borrowing rate on Ethereum is limited to 5.15%, while LST/LRT offers higher returns due to discounts and staking yields. Arbitrageurs can leverage up to 14x in cyclic loans, earning about 45% annualized yield.

What are the consequences? The utilization rate of $WETH will stay at 100%, preventing regular $aWETH holders from withdrawing collateral or refinancing high-cost debt positions into other markets. @monetsupply.eth said this looks more like PR than prudent risk management, and it worsens the situation for ordinary users trapped in the market over the past few days.

Deeper crisis depends on how KelpDAO ultimately distributes the losses. DeFiLlama founder @0xngmi outlined three possible paths, each with vastly different impacts on Aave.

Path one: All $rsETH holders are proportionally deducted by 18.5%. Aave has about 660,000 $rsETH collateralized, most positions close to 95% liquidation LTV. An 18.5% deduction far exceeds the 5% equity buffer, triggering massive liquidations. The total bad debt would be about $216 million. Umbrella insurance covers roughly $55 million, the treasury adds about $85 million, leaving a shortfall of around $76 million. KelpDAO must find a way to cover it.

Path two: Abandon L2 holders, only protect the mainnet. Aave’s $rsETH collateral on L2 is about $359 million. If all positions are at maximum leverage, bad debt could swell to $341 million. Umbrella can’t cover L2 bad debt, so Aave would have to use the treasury or external borrowing. The most likely outcome is a collapse of $rsETH markets on Arbitrum, Mantle, and Base. The $30,000 ETH loan proposal from Mantle would become a joke.

Path three: Pay only the original holders based on the attack snapshot. Theoretically minimal loss, but extremely complex to execute. Post-attack funds have already flowed heavily between DeFi protocols, with lending and liquidity pools mixed, making it impossible to distinguish. The hacker borrowed $124 million on Aave mainnet and $18 million on Arbitrum, totaling $142 million. After Umbrella coverage, net loss is about $91 million. @0xngmi estimates this path has very low probability.

The three paths result in Aave’s net losses ranging from $76 million, $91 million, to $341 million—vastly different outcomes. KelpDAO’s choice will determine whether Aave needs to deploy all its reserves.

On April 23rd, KelpDAO issued a statement reaffirming the principle of prioritizing users, claiming the team and partners made substantial progress on multiple paths, and thanking Arbitrum Security Council and SEAL 911. But they provided no details on specific plans, timelines, or loss-sharing.

Right now, the DeFi United rescue plan seems to be gathering around Aave, with protocol commitments implying Path one as the baseline. But if KelpDAO chooses another path, the narratives around Mantle’s loan, EtherFi, and Lido’s share will have to be completely reworked.

Bro, this story isn’t over yet. Do you follow Aave and bet on Path one, or bail early?

Follow me for more real-time analysis and insights into the crypto market! $BTC $ETH $SOL

#Gate13周年现场直击 #WCTC trading contest with 8 million USDT in prizes #CryptoMarketVolatility