Where Aave’s Exploit Recovery Effort Stands

Hackers unleashed chaos on DeFi last week, compromising admin access of KelpDAO’s LayerZero-powered bridge to open a multi-hundred-million-dollar hole in Aave, the crypto industry’s onchain lending market lynchpin.

Aave lenders rushed for the exits in the immediate aftermath of the attack, spiking utilization rates to 100% in many critical markets, effectively draining all available liquidity and preventing users from making further withdrawals. While fears for industry-wide contagion loomed large in the days that followed, those concerns have since abated, with a donation campaign securing over $300M to backstop the shortfall.

Today, let's take a look at where the exploit recovery effort sits right now.

💸 Exploit Recoveries

Although the early days that followed the KelpDAO exploit were indeed dark, with only $56M in WETH deposits stored in Aave’s staking module reserved against hundreds of millions of dollars in bad debt, the rsETH hole appears to have been plugged.

The first major windfall came last Tuesday, when the Arbitrum Security Council intervened and froze 30,766 ETH (~$70M) related to the exploit that sat idle on its Layer 2 blockchain.

Arbitrum Intervenes, Security Council Freezes $70M ETH Tied to KelpDAO Exploit on Bankless

The action is reigniting industry-wide debate about when blockchain service providers have a responsibility to act.

BanklessJack Inabinet

This bounty of seized assets represents the largest individual contribution that could go toward patching the KelpDAO exploit, but despite its significance, the timeline for recovery remains a tad uncertain.

Moving these funds requires Arbitrum governance to approve a “Constitutional API,” which mandates: a week of forum discussion, an optional one-week temperature check, a three-day voting delay, a 14- to 16-day onchain vote, an eight-day L2 waiting period, an L2-to-L1 message finalization step of typically at least a week, and a final three-day L1 wait before execution.

Although there is an ongoing attempt to circumvent these arduous standards for proposal passage, Arbitrum’s current rules as written entail an estimated 49-day recovery timeline.

Furthermore, even though these funds are the rightful property of KelpDAO exploit victims, they could easily become encumbered by legal challenges. Regulators or law enforcement agencies may seek court-ordered freezes that coerce Arbitrum’s Security Council into keeping the stolen assets immobilized, indefinitely delaying recovery.

Aave risk management group TokenLogic estimates that an additional 14,168 WETH can be recovered by liquidating the exploiter’s positions across Aave and Compound, leaving a residual funding gap of ~75k WETH.

However, much like frozen funds on Arbitrum, the exploiter’s positions on Aave and Compound could become the subject of legal challenge, complicating and prolonging the recovery process.

💪 DeFi United

To address the remaining ~75k WETH shortfall, Aave created DeFi United, a coalition that began soliciting donations from the crypto industry. Unlike the funding addressed above – obtained from stolen sources – donations to DeFi United were freely given and therefore unlikely to face legal entanglement.

Assuming no legal challenges arise against the funds seized by Arbitrum’s Security Council or the exploiter’s lending positions slated for liquidation, DeFi United appears to have succeeded in patching the KelpDAO exploit.

EtherFi, Lido, BGD Labs, Golem, and Aave co-founders Ernesto Boado, Emilio Frangella, and Stani Kulechov have donated a combined 14,350 ETH to DeFi United, with additional donations promised by Ethena, LayerZero, and Ink.

By Friday, the hole appeared to be finally plugged after Aave DAO proposed a 25k ETH donation and Mantle (a major creditor to Aave) agreed to extend a 30k ETH loan to Aave.

Following the apparent recovery, additional capital continued to surface, with Consensys pledging another 30k ETH this morning (though it remains unclear whether the funds were donated or loaned).

🧐 What Comes Next?

With 30,766 ETH frozen on Arbitrum, 14,168 WETH recoverable via liquidation, and more than 100k ETH in pledged donations and loans, the crypto industry appears to have sidestepped what could have been a full-blown catastrophe.

Although Aave’s WETH markets remain gridlocked with 100% utilization, liquidity has finally returned to core stablecoin pools, an early signal that fears of cascading bank runs and bad debt socialization are beginning to ease.

Still, a significant portion of the recovery remains contingent on slow-moving governance processes and the absence of legal challenges, leaving both the timing and completeness of restitution uncertain.