Aave restores WETH limits across six networks as rsETH recovery passes 95%

On May 18, 2026, Aave governance executed proposal 482, restoring wrapped ether (WETH) loan-to-value ratios to pre-exploit levels across six Aave V3 deployments: Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle, and Linea. The action reversed the emergency LTV=0 restrictions the protocol imposed exactly one month earlier after attackers exploited Kelp DAO's LayerZero bridge and deposited unbacked rsETH as collateral against borrowed ETH.

The six-network restoration means users can again borrow against WETH on Aave and use collateral and debt swap functions. On Ethereum Core, LTV moved from 0% back to 80.50%; on Base, from 0% back to 80.00%. The restoration was contingent on two conditions the Aave governance post stated explicitly: rsETH backing efforts progressing as planned and successful deployment of DeFi United funds to cover remaining bad debt across all affected markets.

What the exploit left behind

The April 18 attack targeted the Kelp DAO OFT bridge on the Unichain-to-Ethereum route, which ran a 1-of-1 DVN configuration with LayerZero Labs as sole verifier. Attackers poisoned RPC nodes the DVN used for source-chain verification, forcing a fail-over to compromised infrastructure, and delivered a forged packet that released 116,500 rsETH from the Ethereum-side escrow without any corresponding burn on the source chain.

The result, per Galaxy Research's technical write-up published April 21: 112,204 rsETH became unbacked on the bridge adapter. Only 40,373 rsETH remained in the Ethereum-side adapter as confirmed backing for 152,577 rsETH outstanding on L2s. The attacker deposited the stolen tokens as collateral on Aave, Compound, and Euler, primarily on Ethereum and Arbitrum, and borrowed an estimated $236 million in WETH and wstETH against them.

Llamarisk's incident report to the Aave governance forum modeled two bad-debt scenarios. Scenario 1 distributes losses uniformly across all rsETH holders: estimated bad debt of approximately $123.7 million. Scenario 2 treats the loss as isolated to L2 rsETH only, applying a 73.54% haircut to remote-chain collateral while leaving Ethereum mainnet rsETH intact: estimated bad debt of approximately $230.1 million, concentrated on Mantle (71.45% WETH shortfall) and Arbitrum (26.67%).

Ethereum's total DeFi TVL fell roughly $13 billion in the 48 hours after the exploit, from approximately $99.5 billion to approximately $86.3 billion, as depositors pulled liquidity from Aave and adjacent protocols.

DeFi United: structure and commitments

DeFi United is a cross-protocol coalition formed in the weeks after the exploit to cover the residual bad debt and restore rsETH backing without socializing losses to Aave depositors. By April 25, the coalition had secured $160 million in ETH commitments, with Mantle and Aave DAO pledging a combined 55,000 ETH. LayerZero Labs contributed more than 10,000 ETH — 5,000 directly to DeFi United and 5,000 to strengthen Aave's liquidity.

The technical plan published by DeFi United involves controlled liquidations of the exploiter's remaining rsETH positions on Aave, transfer of recovered rsETH to a DeFi United multisig, and redemption through Kelp's standard procedure. The resulting ETH is applied against the Aave Ethereum and Arbitrum deficits. On May 6, a specifically constructed AIP payload liquidated the exploiter's positions on Aave V3 Ethereum Core and Arbitrum.

As of the May 18 governance action, more than 95% of the unbacked rsETH has been recovered. The remaining shortfall — the gap between what the coalition secured and the actual cleared bad debt — is being covered by DeFi United's committed funds, with recovery tracking closer to Llamarisk's Scenario 1 (uniform socialization) than the $230.1 million L2-isolated worst case.

What remains unresolved

The May 18 restoration is operational, not final. Legal and liability questions persist: no formal agreement on how Mantle and Arbitrum bear their respective shares of residual L2 exposure has been publicly disclosed. The Arbitrum Security Council took emergency action on April 21 to freeze 30,766 ETH and transfer it to an intermediary wallet pending governance; how that tranche is ultimately allocated has not been settled.

Attribution for the attack — LayerZero's post-mortem points to North Korea's Lazarus Group, specifically its TraderTraitor unit — adds a layer of complexity. No recovery from nation-state actors is realistic, meaning DeFi United's coalition backstop is the only practical path to making depositors whole.

The structural question the episode surfaces is whether yield-bearing liquid restaking tokens (LRTs) like rsETH belong as collateral in multi-chain lending deployments at all. A token whose backing lives on an Ethereum-side bridge adapter inherits not just the smart-contract risk of the underlying protocol but the full operational risk of every bridge configuration connecting it to remote chains. Kelp's 1-of-1 DVN choice was a configuration decision, not a code bug — and that choice created systemic exposure across six Aave deployments simultaneously.

Aave has not publicly announced changes to its LRT collateral policy following this incident. LayerZero said it will no longer attest messages from any application running a 1-of-1 DVN configuration.