Author: Curry, TechFlow
Decentralized finance has a core tenet: users' money is held by code, and if something goes wrong, there's no need to find anyone to bail them out.
Now, DeFi's largest lending protocol, AAVE, is organizing the entire industry to pool money for a bailout.
In the early hours of April 23, Aave founder Stani Kulechov posted on X, saying he would contribute 5,000 ETH—worth approximately $11.5 million at current prices—to a fund called "DeFi United."
This money is to fill a hole.
Six days earlier, a hacker exploited a vulnerability in the KelpDAO cross-chain bridge to mint a batch of fake tokens backed by zero collateral, stuffed them into Aave as collateral, and borrowed nearly $200 million worth of real ETH. Aave is the largest lending protocol in DeFi, managing over $30 billion in user assets. After the news broke, whales and institutional users were the first to flee. Within six days, Aave's total deposits evaporated by nearly $15 billion, and its core liquidity pools were drained to the bottom.
(Reference: "After the KelpDAO Hack, AAVE's Situation Is Worse Than You Think")
Depositors who didn't flee can now no longer withdraw their own funds. According to CoinDesk, the utilization rate of USDT and USDC liquidity pools once approached 100%.
The wording of Stani's tweet is worth noting. He called Aave his "life's work." When a founder publicly uses that term, it usually means things have gotten serious enough to warrant a statement.
So, DeFi United is an industry bailout mechanism spearheaded by the Aave founder. As of today, those who have publicly committed funds include Ethereum staking protocol Lido, restaking protocol EtherFi, the Golem Foundation, and Mantle under Bybit—five entities in total.
However, a closer look reveals that the bailout from these five is not yet fully in place.
Currently, what is fully confirmed is Stani's own 5,000 ETH and the 1,000 ETH from the Golem Foundation. Lido's proposal to allocate 2,500 stETH and EtherFi's proposal to contribute 5,000 ETH are both still going through their respective DAO voting processes. Mantle's proposed 30,000 ETH is structured as a loan and is still in the planning stage on its governance forum.
Furthermore, Lido's proposal includes a precondition: funds will only be released once a complete recovery plan is assembled. Meaning, if the total isn't raised, it might not contribute.
How big was the hole left by the KelpDAO hack?
The hacker borrowed approximately 99,600 ETH in total. The Arbitrum Security Council froze 30,700 of those, leaving a residual gap of approximately 68,900 ETH, worth around $160 million.
The total potential support from the five parties amounts to approximately 43,500 ETH. There's still a gap of 25,000 ETH, which no one has claimed yet.
DeFi Version of the "Troubled Asset Relief Program"
In September 2008, two weeks after Lehman Brothers collapsed, the U.S. Treasury launched something called TARP, which stands for the "Troubled Asset Relief Program." Simply put, Wall Street caused a mess, and the government organized a group of financial institutions to pool money, jointly absorb bad debts, and prevent the entire system from cascading into collapse.
Structurally, what DeFi United is doing is almost identical to TARP.
If Aave's bad debt isn't cleaned up, the consequences won't be limited to Aave alone. The token rsETH is used as collateral by many DeFi protocols. According to the Aave incident report, Aave alone held approximately 83% of the circulating rsETH supply.
If the peg of this asset cannot be restored, the bad debt will spread like a contagion to all protocols that accept rsETH. According to Lido's proposal description, users of just a single yield vault, EarnETH, could face forced liquidation losses of up to 9,000 ETH.
This is why even competitors are chipping in. Lido and EtherFi are not in the same camp as Aave; they also operate their own lending or staking businesses. But if rsETH completely de-pegs, their users and liquidity pools will suffer too. Saving Aave is essentially saving themselves.
The logic of a financial crisis is probably similar. Goldman Sachs didn't agree to put money into TARP because it liked Merrill Lynch; it was because if Merrill Lynch fell, Goldman Sachs wouldn't survive either. The contagious nature of the financial system determines that when an institution deemed "too big to fail" has problems, everyone has to chip in.
But we all understand the key difference.
Behind TARP stood the U.S. Treasury and the Federal Reserve. The Treasury had the authority to force financial institutions to participate, and the Fed could inject unlimited liquidity.
Behind this DeFi United, no single authority can force anyone to contribute money. Lido's 2,500 stETH awaits a DAO vote, EtherFi's 5,000 ETH awaits a DAO vote, and Mantle's 30,000 ETH awaits governance discussion.
So the current predicament for DeFi, or AAVE, is that it needs a "bailout plan," but its bailout plan is a crowdfunding campaign. Whether DeFi United succeeds depends on the community vote of each participating party, deciding whether it's worth using their own treasury funds to fill someone else's hole.
This is probably the first time the crypto industry has reached this crossroads.
In the past, when a DeFi protocol had problems, either the founding team would cover the costs themselves, or users would accept the loss and walk away. There has never been a time when competitors needed to sit down and jointly inject funds to save a shared systemic risk.
Am I Paying the Bill Again This Time?
Whether DeFi United will ultimately be able to raise the required 68,900 ETH is unknown today. But one thing is already certain: regardless of the outcome, those who will pay for this hole have already been identified.
According to the incident report on the Aave governance forum, if the gap cannot be fully covered, the bad debt will be socialized among Aave's depositors. Specifically, those who deposited WETH into Aave to earn interest might find their account balances have been haircut.
According to the report's estimates, the scale of the bad debt depends on how the rsETH loss is distributed, with a minimum of approximately $123 million and a maximum of $230 million.
What did these users do? Deposit some ETH, earn a few percent APY. They probably didn't know KelpDAO would have problems, nor that there was a cross-chain bridge using a message verification mechanism called LayerZero, and this mechanism had security configuration issues.
But their money became the counterparty for the ETH the hacker borrowed.
If all proposals pass and all funds are fully delivered, the depositors might get off scot-free. If the funds can't be raised, these users' deposits will be cut, with the haircut depending on the size of the gap.
And they have no voting power in this process. The depositors who bear the actual consequences have no button to press in this process.
According to CoinDesk, Circle's Chief Economist, Gordon Liao, has already proposed an emergency plan on the Aave governance forum, suggesting raising the borrowing rate cap from 10% to 50% to attract new funds with high interest and alleviate the liquidity crunch...
In other words, Aave's current strategy is to use more expensive money to fill a deeper hole.
After the 2008 financial crisis, the world spent a lot of time establishing various deposit insurance systems, stress tests, and systemic risk regulatory frameworks, with one core goal:
To prevent ordinary depositors from paying for the risky behavior of financial institutions.
DeFi spent nearly 10 years building a system that bypassed these rules. But the pitfalls the banking industry stumbled over for centuries won't automatically disappear just because you change the code. Deposit runs, bad debt contagion, and innocent depositors forced to pay the bill—none of them are missing, just as before.
As of press time, the available liquidity in the USDC pool on Aave is less than $3 million. If you wanted to withdraw your stablecoins from DeFi's largest lending protocol right now, you most likely still couldn't.
Whether DeFi or CeFi, let's hope ordinary people aren't the ones paying the bill this time.
