A US$290M exploit at Kelp DAO became a systemic risk for all of DeFi, and the response may be the origin of an on-chain deposit-insurance fund. Coordinated by Stani Kulechov (Aave), eight competing protocols voluntarily united to cover the shortfall, replicating in open source the logic that gave rise to the FDIC in 1933.
How a bug became systemic risk
On April 18, 2026, an exploit on Kelp DAO's cross-chain bridge (LayerZero, a misconfigured 1-of-1 DVN setup) minted ~116,000 unbacked rsETH, worth ~US$290 million. The attacker deposited the tokens as collateral on Aave and drew ~US$190M in ETH, turning a point problem into systemic risk for the entire lending ecosystem: an on-chain bank run of US$12-15 billion in 72 hours and potential bad debt of US$124-230M depending on how losses are socialized. A coalition of eight protocols funded the rescue: Stani Kulechov contributed 5k ETH personally, Lido committed 2.5k stETH, EtherFi 5k ETH, and Mantle Treasury made the largest single commitment with a 30k ETH loan, alongside an extended coalition of seven protocols (Golem, LayerZero, Arbitrum, Ethena, Frax, Ink Foundation, Tydro). The read: DeFi United replicates in a decentralized environment the same logic that created the FDIC in the US (1933) and the FGC in Brazil, competitors that unite when there is systemic risk, showing DeFi does not need to be rupture, it needs to be improvement.
Key findings
- A misconfigured 1-of-1 DVN on the Kelp DAO / LayerZero bridge minted ~116,000 unbacked rsETH (~US$290M), which the attacker used as Aave collateral to draw ~US$190M in ETH.
- The incident triggered an on-chain bank run of US$12-15B in Aave withdrawals over 72 hours and potential bad debt of US$124-230M.
- Eight competing protocols covered the shortfall, with Mantle Treasury's 30k ETH loan the largest single commitment, an open-source echo of the FDIC (1933) and Brazil's FGC.