News linked to both this project and an event.
Linda Jeng, Chief Legal and Policy Officer at Aave Labs, stated during Consensus Miami 2026 that Aave's previous risk framework overly focused on financial risks and price volatility. Looking ahead, the protocol will incorporate assessments of cross-chain interoperability, cybersecurity vulnerabilities, and underlying asset architecture.This reform directly stems from the rsETH incident that occurred in April. At that time, an attacker exploited a vulnerability in the KelpDAO cross-chain bridge to mint approximately 116,500 unbacked rsETH (valued at around $293 million), deposited it as collateral into Aave, and borrowed real WETH, leading to significant bad debt risks for the protocol.Jeng revealed that Aave will also release a formal "listing standards handbook" for asset issuers in the future, and will begin evaluating the correlation between DeFi protocols from a systemic risk perspective, rather than analyzing individual pools in isolation.Additionally, a "DeFi United" bailout plan involving Lido Finance, EtherFi, Ethena, and others has been launched to cover collateral shortfalls and prevent further proliferation of bad debt. (CoinDesk)
Lido has provided the latest update on the Kelp security incident, stating that the Snapshot vote regarding the EarnETH first-loss protection mechanism falling below the 1% threshold has reached quorum and been approved. User losses from EarnETH will be fully covered by Lido Earn’s first-loss mechanism. The rsETH held by the attacker has been liquidated, and the related stETH has been transferred to the DeFi United rescue plan.Additionally, the EarnETH vault is expected to reopen shortly after the Kelp protocol resumes operation, at which point users will be able to deposit and withdraw funds normally. Lido emphasized that during the freeze period, both the EarnETH and EarnUSD vaults continued to generate yield. Currently, EarnETH users only need to wait for a brief unfreezing process to complete. Once funds are restored, compensation will be provided in accordance with the first-loss protection mechanism.
According to the Lido Governance Forum, Lido Earn contributors have submitted a proposal to the DAO requesting authorization to deploy the existing First Loss Reserve to cover losses arising from the Kelp incident, waiving the original 1% threshold requirement. It is estimated that, assuming the DeFi United rescue plan succeeds, the remaining borrowing-rate losses for Lido Earn’s leveraged staking/re-staking positions will amount to approximately 400–600 ETH. Contributors stated they will collaborate with curators to jointly absorb these losses; however, full coverage by curators alone is currently deemed unrealistic. The proposal stresses that this authorization constitutes a one-time exception specific to the Kelp incident and does not alter the standard 1% threshold rule, does not involve additional treasury allocations, and is not intended to subsidize APY or support post-recovery yields. It further notes that if litigation arises from these losses, associated legal costs alone could reach several hundred thousand dollars. Given that the rsETH situation is expected to be resolved within 5–10 days—and considering the standard snapshot voting window is 7 days—the proposers emphasize the time-sensitive nature of this vote. After resolution, the team plans to publish a comprehensive post-mortem report and advance improvements to risk frameworks and operational mechanisms.
Circle Ventures, Consensys, and Joseph Lubin have announced their support for the DeFi United initiative, aimed at mitigating losses caused by the Kelp DAO vulnerability. Circle Ventures is supporting the ecosystem by purchasing AAVE tokens. Consensys and Ethereum co-founder Joseph Lubin have confirmed the provision of 30,000 ETH to DeFi United. To date, DeFi United has raised over 132,000 ETH, with a total value exceeding $300 million. These funds will be used to cover bad debts resulting from an attacker minting unbacked rsETH via the LayerZero bridge and borrowing assets on Aave. Previously, Aave proposed a donation of 25,000 ETH, while Lido DAO, Ether.fi, and Kelp have respectively proposed or pledged donations of 2,500 ETH, 5,000 ETH, and 2,000 ETH.
KelpDAO announced that, since April 18, it has been coordinating with Aave and ecosystem partners to restore rsETH holdings for rsETH holders. The initial shortfall from this incident was 163,200 ETH. To date, Kelp has recovered 40,300 rsETH—approximately 43,000 ETH—and the Arbitrum Security Council has separately secured 30,700 ETH. The remaining shortfall stands at approximately 89,500 ETH. Kelp stated that, of this remaining shortfall, Mantle, Stani Kulechov, EtherFi, Lido, and Golem have publicly committed to contributing a total of 43,500 ETH, and Kelp is working with these partners to formalize those contributions. Kelp emphasized that rsETH holders are the top priority.
Lido has released an update regarding the Kelp security incident, stating that its Earn-series vaults are working with the management team to address the issue, focusing on two key risk areas: rsETH exposure and tightening liquidity in lending markets. Lido emphasizes that its core staking protocol remains unaffected, and both stETH and wstETH remain secure and stable. Currently, only the EarnETH vault holds approximately 9% of its TVL in rsETH exposure; related deposits and withdrawals have been suspended by the management team pending resolution. Of the ~$70 million in ETH stolen in the earlier attack, roughly $70 million has already been recovered; asset recovery and loss allocation efforts are ongoing. To mitigate liquidity pressure, the management team has reduced leverage and optimized position structures, significantly decreasing wETH debt exposure. Should losses ultimately materialize, EarnETH will activate its $3 million “first-loss protection mechanism,” funded by the DAO. Other vaults remain unaffected: DVV and EarnUSD are operating normally. The GGV sub-vault is currently experiencing negative yields due to a combination of recursive staking strategies and rising borrowing rates, but active adjustments are underway. Users’ previously submitted withdrawal requests will be processed at pre-incident valuations.
Odaily News: The Ethereum Community Hub, supported by the Ethereum Foundation, has announced it will be held in Hong Kong at 1:30 PM on April 21st. ETH HK HUB is Asia's first offline Ethereum community Hub, supported by the Ethereum Foundation and jointly operated by SNZ and ETHTAO, aiming to build a collaborative hub connecting Asia with the global Ethereum ecosystem. The event will cover areas including: ZK, privacy computing, AI × blockchain, stablecoins and payments, on-chain liquidity, and more.Participating institutions and projects include Sharplink, Brevis, Primus, HashKey Chain, Chainlink Labs, Lido Finance, Galaxy Digital, SignalPlus, Morpho, Animoca Brands, EVG, Zand Bank, Pay Protocol, and others. Guests include Vitalik Buterin, Aya Miyaguchi, and more.