LondonAave restored borrowing after 95% exploit recovery.
A Kelp DAO bridge exploit minted $292 million in unbacked rsETH tokens; on-chain liquidations and the DeFi United coalition backstop recovered 95%.
Legal disputes over who covers the residual 5,200 rsETH remain unresolved, governance documents show.
Sources: CoinDesk
WHAT AAVE ACTUALLY IS
Aave is a pool-based lending protocol: users deposit assets into a smart contract, others borrow against collateral they've also deposited. There is no loan officer, no credit check — the collateral ratio is enforced by code, and if it falls below a threshold, anyone can trigger a liquidation and claim a fee.
WHY BRIDGES ARE THE WEAK LINK
A bridge holds real assets on one chain and mints a derivative token on another, backed 1:1. If the minting logic is tricked, the derivative loses its backing instantly — but it still circulates as collateral across DeFi until the market notices. Bridges have lost more crypto to hacks than any other category: Ronin, Wormhole, Nomad, Harmony, all in the same playbook.
THE LIQUID-RESTAKING WRINKLE
rsETH is a liquid restaking token — ETH staked through EigenLayer, wrapped so it can be used elsewhere while still earning yield. Each layer of wrapping adds a contract that must be solvent for the token's peg to hold. Kelp's bridge was one such layer.
HOW ON-CHAIN LIQUIDATION WORKS
When unbacked rsETH was pledged as collateral and the price cratered, the loans went underwater within minutes. Bots monitoring Aave's contracts repaid the bad debt and seized the remaining collateral for a bounty. The same automation that makes DeFi brittle in a crisis is what limits the damage.
THE MISSING BACKSTOP
Traditional finance has the FDIC, the Fed's discount window, deposit insurance. DeFi has no lender of last resort — when a protocol takes a loss, either a token-holder vote socializes it, a peer-coalition steps in voluntarily, or the loss sits on user balances forever. The 'DeFi United' coalition covering most of this shortfall is an ad-hoc precedent, not a standing institution.
THE LEGAL VOID
Who owes the remaining 5,200 rsETH is a question with no court of competent jurisdiction. Aave is a Cayman foundation, Kelp is pseudonymous governance, the exploit happened on Ethereum mainnet. Smart contracts execute regardless of which national law would have applied; the residue is left to governance forums and Twitter.