Aave published an official postmortem tracing a $230 million exploit to a LayerZero bridge verification failure and announced a sweeping overhaul of its asset-listing standards as DeFi risks shift beyond smart contract bugs.
Aave has progressed to Phase II of recovering exploited rsETH funds following a $200 million bad debt event linked to the Lazarus Group, with $71 million in ETH returns moving forward despite no flaws in Aave's own contracts.
A coalition of DeFi protocols including Aave, Compound, and others unveiled a detailed technical plan to eliminate bad debt and restore full backing for exploited rsETH tokens following the $290 million Kelp DAO hack, with pledges totaling over $300 million in recovery funds.
Mantle, EtherFi Foundation, Golem Foundation, Lido DAO, Ethena, LayerZero, Ink Foundation and Tyrdo pledged combined 43,000 ETH to 'DeFi United' recovery effort to restore rsETH backing following the $292 million Kelp DAO exploit.
Attackers drained approximately 116,500 rsETH (roughly $292-293 million) from Kelp DAO's LayerZero-powered bridge, causing emergency freezes across multiple DeFi protocols including Aave, SparkLend, Fluid, and Upshift. The exploit represents 2026's largest crypto hack to date and impacted at least nine protocols.
