In response to a $292 million exploit that has left a significant collateral shortfall, Aave and several prominent crypto firms have launched a coordinated recovery effort, dubbed 'DeFi United', to stabilize decentralized finance (DeFi) markets. The initiative aims to restore the backing of rsETH, a yield-bearing derivative token of ether (ETH), which is at the center of the exploit.
Aave has announced that multiple participants have already committed to supporting the effort, with Lido Finance's ecosystem contributor, Lido Labs Foundation, proposing to allocate up to 2,500 stETH, valued at approximately $5.7 million, to a dedicated relief fund. EtherFi has also proposed a 5,000 ETH plan to 'protect users and prevent bad debt' across DeFi. Aave's founder, Stani Kulechov, has pledged a 5,000 ETH contribution, stating that 'Aave is my life's work and we're working nonstop to find the best possible outcome for users.' The exploit, which is the largest crypto theft of the year, has sent shockwaves through DeFi lending markets. It is attributed to a vulnerability in KelpDAO's integration with LayerZero, which allowed an attacker to mint 116,500 unbacked rsETH tokens.
The attacker then deposited nearly 90,000 rsETH into Aave as collateral, borrowing approximately $190 million in ETH and other assets. This has resulted in a significant shortfall in collateral, triggering a rush of withdrawals and a $10 billion decline in the total value of assets on Aave. The total estimated shortfall is over 112,000 rsETH, according to Aave's incident report. Prior to the DeFi United initiative, some early containment efforts were made, including the freezing of 30,766 ETH, worth approximately $71 million, by Arbitrum's security council.
However, the remaining stolen funds were bridged and swapped into bitcoin via Thorchain, complicating recovery efforts. The current effort focuses on stabilizing the system through a coordinated bailout to recapitalize rsETH and mitigate losses, rather than attempting to recover the stolen funds.