Eleven of the largest Ethereum decentralized finance protocols announced on Friday a coordinated $180 million commitment to establish the DeFi Emergency Response Fund, an industry-wide insurance and rapid-response facility created in direct reaction to the $292 million KelpDAO exploit that shook the Ethereum ecosystem on Tuesday.
Aave contributed $40 million, Lido Finance $35 million, MakerDAO (now Sky) $30 million, and contributions of $10-20 million each came from Rocket Pool, EigenLayer, Pendle, Curve, Morpho, Ondo Finance, Eigenpie, and Ethena. The fund will operate under a 7-of-11 multi-sig with a 48-hour response mandate for protocol exploits above $25 million in losses.
KelpDAO Postmortem Reveals Oracle Failure
KelpDAO released its forensic postmortem Thursday identifying a Chainlink oracle manipulation vector combined with a reentrancy bug in the rsETH redemption contract as the root cause. The attacker minted 112,000 rsETH tokens without depositing collateral, then redeemed them against the pool before oracle updates could flag the discrepancy. Chainlink has since deployed patched feeds and tightened price-deviation thresholds across all liquid-staking derivative pairs.
Of the $292 million in stolen funds, approximately $48 million has been recovered through on-chain negotiations with a white-hat attacker who received 10% as a bounty. An additional $112 million is frozen in addresses flagged by Tether and Circle, leaving roughly $132 million currently at large. The attacker has laundered a portion through Tornado Cash variants.
Institutional DeFi TVL Resumes Growth
Total value locked in Ethereum DeFi protocols fell to $78 billion on Wednesday from $92 billion pre-hack but has since recovered to $85 billion as the Emergency Response Fund announcement restored confidence. Liquid staking derivatives, the category most directly implicated by the KelpDAO exploit, saw TVL stabilize around $42 billion after briefly dipping to $37 billion.