Aave Is in Trouble—The Entire Industry Is Pitching In

Author: Kuli, TechFlow

Decentralized finance (DeFi) rests on a core tenet: users’ funds are held by code—not by people—and when things go wrong, there’s no one to bail you out.

Now, Aave—the largest DeFi lending protocol—is organizing the entire industry to collectively cover losses.

In the early hours of April 23, Stani Kulechov, Aave’s founder, posted on X announcing he would contribute 5,000 ETH—worth roughly $11.5 million at current market prices—to a fund called “DeFi United.”

This money is meant to fill a hole.

Six days earlier, a hacker exploited a vulnerability in KelpDAO’s cross-chain bridge to mint counterfeit tokens with no underlying collateral, deposited them as collateral into Aave, and borrowed nearly $200 million worth of real ETH. Aave, the largest DeFi lending protocol, manages over $30 billion in user assets. Once news broke, whales and institutional users fled first: within six days, Aave’s total deposits evaporated by nearly $15 billion, draining its core liquidity pools to near exhaustion.

(See also: “After the KelpDAO Hack, Aave Is in Worse Shape Than You Think”)

Depositors who stayed behind can’t even withdraw their own funds. According to CoinDesk, utilization rates for USDT and USDC liquidity pools briefly approached 100%.

The wording of Stani’s tweet is telling: he described Aave as his “life’s work.” When a founder publicly uses that phrase, it usually signals that things have grown serious enough to warrant a public commitment.

Thus, DeFi United is an industry-wide rescue mechanism spearheaded by Aave’s founder. As of today, five entities have publicly pledged contributions: Lido (an Ethereum staking protocol), EtherFi (a restaking protocol), the Golem Foundation, and Mantle (a Bybit-affiliated Layer 2 network).

Yet a closer look reveals these pledges aren’t fully secured yet.

So far, only two contributions are confirmed: Stani’s personal 5,000 ETH and the Golem Foundation’s 1,000 ETH. Lido’s proposal to allocate 2,500 stETH and EtherFi’s proposal to contribute 5,000 ETH remain pending votes in their respective DAOs. Mantle’s proposed loan of 30,000 ETH is still in the planning stage on its governance forum.

Moreover, Lido’s proposal includes a condition: disbursement will occur only after a complete recovery plan is finalized. In other words, if the full funding target isn’t met, Lido may withhold its contribution.

How large was KelpDAO’s shortfall?

The hacker withdrew approximately 99,600 ETH; the Arbitrum Security Council froze 30,700 ETH, leaving a remaining gap of ~68,900 ETH—valued at roughly $160 million.

The combined potential contributions from all five parties total about 43,500 ETH—still short by roughly 25,000 ETH, with no party stepping forward to cover the remainder.

A DeFi-Style “Troubled Asset Relief Program”

In September 2008—two weeks after Lehman Brothers collapsed—the U.S. Treasury launched TARP, the Troubled Asset Relief Program. In essence: Wall Street caused a crisis, so the government organized financial institutions to pool capital and jointly absorb bad debt—preventing systemic contagion.

DeFi United operates almost identically in structure.

If Aave’s bad debt remains unfilled, the consequences extend far beyond Aave itself. The token rsETH is widely used as collateral across numerous DeFi protocols. According to Aave’s incident report, Aave alone holds roughly 83% of the circulating supply of rsETH.

If rsETH fails to recover its peg, the contagion will spread like wildfire to every protocol accepting it as collateral. As noted in Lido’s proposal, just one yield vault—EarnETH—could face forced liquidations totaling up to 9,000 ETH.

That’s why even competitors are pitching in. Though Lido and EtherFi operate competing lending or staking businesses, they too suffer if rsETH fully depegs—their users and liquidity pools would be impaired. Bailing out Aave is, fundamentally, bailing out themselves.

Financial crisis logic works similarly: Goldman Sachs didn’t contribute to TARP out of affection for Merrill Lynch—it did so because if Merrill fell, Goldman wouldn’t survive either. Systemic interdependence dictates that when an institution is “too big to fail,” everyone must chip in.

But we all know the crucial difference.

TARP stood behind the authority of the U.S. Treasury and the Federal Reserve. The Treasury could compel participation; the Fed could inject unlimited liquidity.

This time, DeFi United has no such authority. Lido’s 2,500 stETH awaits DAO approval; EtherFi’s 5,000 ETH awaits DAO approval; Mantle’s 30,000 ETH awaits governance discussion.

So Aave—or DeFi more broadly—now faces this paradox: it needs a bailout program, but its bailout program is a crowdfunding campaign. Whether DeFi United succeeds depends entirely on each participant’s community vote—on whether their treasury should pay to fix someone else’s hole.

This may be the first time the crypto industry has reached such a fork in the road.

In the past, when DeFi protocols failed, either the founding team covered losses out of pocket—or users absorbed the losses and walked away. Never before has a coordinated capital injection from competitors been required to address a shared systemic risk.

Again, I’m the One Paying?

No one knows yet whether DeFi United will raise the full 68,900 ETH needed. But one thing is already certain: regardless of the outcome, the party selected to foot the bill has already been chosen.

According to Aave’s incident report published on its governance forum, if the shortfall remains unfilled, bad debt will be distributed among Aave’s depositors. Specifically, users who deposited WETH to earn yield may find their balances reduced proportionally.

The report estimates total bad debt exposure depending on how rsETH losses are allocated—ranging from a minimum of ~$123 million to a maximum of ~$230 million.

What did these users do? They deposited some ETH and earned modest annual yields. They likely had no idea KelpDAO would fail—or that its cross-chain bridge relied on a message verification mechanism called LayerZero, whose security configuration was flawed.

Yet their funds served as the counterparty to the ETH borrowed by the hacker.

If all proposals pass and all funds materialize, depositors may walk away unscathed. If funding falls short, their deposits will be haircut—by an amount proportional to the shortfall.

And they hold no voting rights on this matter. The very users bearing the consequences have no “vote” button to press in this process.

According to CoinDesk, Gordon Liao, Circle’s Chief Economist, has already proposed an emergency measure on Aave’s governance forum: raising the borrowing rate cap from 10% to 50%, aiming to attract new capital and ease liquidity stress…

In other words, Aave’s current strategy is to borrow more expensive money to dig itself out of a deeper hole.

After the 2008 financial crisis, the world spent years building deposit insurance schemes, stress-testing frameworks, and systemic-risk oversight mechanisms—all aimed at one core objective:
ensuring ordinary depositors no longer pay for financial institutions’ risky behavior.

For nearly a decade, DeFi built a system designed to bypass those safeguards. Yet the pitfalls banks stumbled into over centuries won’t vanish simply because the rules are written in code. Bank runs, bad-debt contagion, and innocent depositors forced to pay—none of these disappeared. They arrived right on schedule.

At the time of publication, Aave’s USDC liquidity pool holds less than $3 million in available liquidity. If you’re trying to withdraw your stablecoins from DeFi’s largest lending protocol right now, odds remain high that you’ll be unable to do so.

Whether in DeFi or CeFi—we hope this time, it won’t be ordinary people who pay.