The official DeFi United site shows over 69,550 ETH raised from 222 wallets across 1,623 transfers, all aimed at restoring rsETH backing, acting as DeFi’s emergency recapitalization desk.
The effort is the closest thing the industry has built to a lender of last resort, assembled without a regulator, a central bank, or a mandate.
Aave’s governance proposal puts the original rsETH shortfall at approximately 163,183 ETH.
Recoveries and freezes, which include 43,168 ETH from Kelp, 30,766 ETH frozen by the Arbitrum Security Council, up to 12,323 WETH from Aave liquidations, and 1,845 WETH from Compound, reduce the residual funding gap to about 75,081 ETH.
DeFi United’s current top line covers roughly 92.5% of that residual, leaving approximately 5,632 ETH. A broader tracker snapshot shows 100,200 ETH committed against a 116,500 ETH target when the Arbitrum frozen recovery path is included, putting total coverage at about 86%.
Both numbers carry the same caveat that the fund is close on paper, while most of the largest pieces are still pending governance votes, and several key contributions carry no disclosed amount.
How the hole got this large
KelpDAO’s rsETH bridge ran a 1-of-1 configuration with LayerZero Labs as the sole verifier.
Galaxy’s research found that the attacker exploited that setup to unlock 116,500 rsETH from Ethereum mainnet escrow, then used the stolen tokens as collateral across Aave, Compound, and Euler to borrow an estimated $236 million in WETH and wstETH.
Within 48 hours, DeFi’s total value locked fell by roughly $13 billion. Aave alone shed about $8.45 billion in TVL, with WETH utilization hitting 100% as users rushed for the exits, simultaneously pushing USDT and USDC pools to full utilization.
LayerZero’s own incident statement characterized the attack as RPC poisoning targeting infrastructure used by its decentralized validator network (DVN), stopping short of identifying a flaw in the LayerZero protocol itself.
The bridge route still depended on LayerZero Labs as the sole verifier, a configuration that concentrated trust in a single point. DeFi United lists LayerZero as “Confirmed, TBD.”
Because the entire incident ran through that bridge configuration, LayerZero’s undisclosed contribution is one of the most consequential missing numbers in the recovery.
ContributorStatusAmountWhy it mattersMantlePending vote30,000 ETHLargest disclosed contribution; central to closing the gapAave DAOPending vote25,000 ETHCore treasury backstop and the clearest test of DAO willingness to absorb lossesStani KulechovCommitted5,000 ETHPersonal founder-level signal that adds credibility to the effortEtherFiPending vote5,000 ETHMajor ecosystem support before the full governance package is finalizedLidoPending vote2,500 ETHImportant because it opens a precedent debate around covering losses outside Lido’s own protocolGolem FoundationCommitted1,000 ETHConfirmed support from a recognized ecosystem participantEmilio FrangellaCommitted500 ETHVisible individual contribution that reinforces the public-coordination angleBGD Labs + ErnestoCommitted350 ETHService-provider support tied closely to Aave’s risk and governance machineryLayerZeroConfirmed, TBDTBDMost consequential undisclosed number because the incident centered on the bridge route using LayerZero infrastructureEthenaConfirmed, TBDTBDMaterial participant, but amount not yet disclosedInk FoundationConfirmed, TBDTBDMaterial participant, but amount not yet disclosedFrax FinanceConfirmed, TBDTBDMaterial participant, but amount not yet disclosed
The coordination case
DeFi United assembled without a regulatory mandate, a central bank, or an order from anyone.
Before Aave’s treasury proposal even entered governance, EtherFi, Lido, Mantle, Ethena, Ink, BGD Labs, Emilio Frangella, Ernesto, and Aave’s founder Stani Kulechov had already assembled 14,570 ETH in pledges.
The fund’s named contributors now include Mantle with 30,000 ETH pending vote, Aave DAO with 25,000 ETH pending vote, Kulechov personally committing 5,000 ETH, EtherFi at 5,000 ETH pending vote, Lido at 2,500 ETH pending vote, Golem Foundation at 1,000 ETH, Frangella at 500 ETH, and BGD Labs plus Ernesto at 350 ETH.
LayerZero, Ethena, Ink Foundation, and Frax Finance are confirmed, with amounts still undisclosed.
Aave’s ARFC frames its participation under a “No Ghost Left Behind” posture, citing the DAO’s prior decision to cover CRV-related bad debt directly, shielding suppliers from socialized losses.
That framing of voluntary, cross-protocol, and publicly visible is the strongest argument the industry can make for its own self-governance capacity.
The centralization embedded in the rescue
Aave’s proposal authorizes Aave Labs to negotiate loans, settlements, indemnities, under-collateralized lending arrangements, warrants, token sales, and deployment of future protocol revenue.
The Mantle contribution is structured as a credit facility, with later donations earmarked to repay Mantle, leaving Aave’s treasury ask unchanged.
Aave’s math treats the Arbitrum Security Council’s 30,766 ETH as a recoverable stream that requires further governance action to release and sits outside DeFi United’s control, as the site explicitly acknowledges. The same applies to KelpDAO reopening withdrawals and LayerZero reopening the bridge.
The Arbitrum intervention cuts to the center of the decentralization contradiction. A security council with emergency powers froze tens of thousands of ETH linked to the exploit and moved it into a controlled intermediary wallet.
That action helped contain the damage, and also required someone with the power to say no and to use it unilaterally in a crisis. In a system built around credible neutrality, the freeze both saved and complicated the narrative.
What governance is actually debating
Aave’s forum has already produced the backlash the situation invites. One commenter argues the recovery math is sound but says the DAO should not move to a Snapshot vote until governance adopts a collateral-risk framework that would have blocked rsETH from being listed at those parameters.
Paying the bill without fixing the kitchen solves the immediate crisis and creates conditions for the next one.
Another voice in the same thread argues that the parties most responsible for the configuration are contributing proportionally less than the burden they impose on Aave.
Lido’s parallel forum debate sharpens the question of precedent. Its proposal authorizes up to 2,500 stETH but only as part of a fully funded recovery package, with Lido noting that the alternative could expose its EarnETH vault to roughly 9,000 ETH in losses.
Delegates are openly debating if the contribution is a donation, if it should carry better terms, and if participation sets a precedent for covering losses originating outside Lido’s own protocol.
Two paths forward
In the bull case, the pending governance votes clear quickly, Kelp and bridge-side mechanics reopen in an orderly sequence, Arbitrum governance releases the frozen ETH, and the remaining TBD participants close the gap.
The recovery becomes a working model for cross-protocol crisis coordination, proof that DeFi can self-insure without external backstops, and that the governance layer functions even when composability fails at the infrastructure level.
The backlash about collateral risk reform gets folded into the next governance cycle, leaving the rescue intact.
In the bear case, one or more of the largest pending votes or external recovery steps slip. The Arbitrum freeze stays politically contested.
LayerZero’s contribution, once disclosed, falls short of what the bridge’s structural role in the incident warrants. Aave’s balance sheet absorbs more of the residual for longer than the proposal anticipates, and the governance backlash hardens around who decided that a 1-of-1 bridge-backed token qualified as acceptable collateral at those parameters.
DeFi United still exists in this version, but it becomes the case study in how the industry coordinates around downside on terms set by the largest actors.
ScenarioWhat goes right or wrongWhat it means for usersWhat it says about DeFiBull casePending votes pass, Arbitrum releases frozen ETH, Kelp and bridge-side mechanics reopen in order, and TBD contributors close the remaining gaprsETH backing normalizes and users avoid a longer, messier recoveryDeFi shows it can coordinate fast enough to self-insure against a nine-figure exploitBear caseOne or more major votes or external recovery steps slip, LayerZero’s disclosed contribution disappoints, and Aave carries more of the residual for longerRecovery drags out, uncertainty lingers, and affected users remain dependent on protocol politicsDeFi looks less like neutral infrastructure and more like a system governed by the largest actors under stressKey dependencyThe outcome still depends on Arbitrum governance, KelpDAO actions, LayerZero bridge-side steps, and DAO approvals outside DeFi United’s direct controlUsers are exposed not only to funding risk but also to timing and coordination riskThe rescue is decentralized in branding but centralized at key decision pointsGovernance lessonRescue money arrives before collateral-risk reform is fully settledUsers may be made whole now, but future listing standards remain contestedDeFi can mobilize for recovery faster than it can agree on preventionLong-term consequenceThe rescue succeeds and reforms followConfidence stabilizes, but the market becomes more skeptical of bridge-backed collateralBailout politics become part of the operating reality of “decentralized” finance
DeFi United may close the gap, restore rsETH backing, and demonstrate that decentralized protocols can absorb a nine-figure exploit without systemic collapse. The recovery effort so far gives genuine grounds for that conclusion.
The rescue’s architecture of pending votes, a private credit facility, a security council’s freeze button, undisclosed negotiations, and legal instruments authorized by a DAO also describes a financial system that runs on credible neutrality until the losses are large enough, and then runs on whoever has the keys.
