Bybit-backed Ethereum Layer 2 network Mantle proposed a loan of up to 30,000 ETH to Aave DAO to help the protocol absorb bad debt from the $292 million Kelp DAO exploit last week.

On Thursday, the Mantle Core Contributor Team published a new proposal, MIP-34, which detailed a strategic credit facility for Aave DAO to address the rsETH exploit.

The proposal, if passed, would authorize Mantle Treasury to lend up to 30,000 ETH to Aave DAO, to be used exclusively for resolving the rsETH bad debt on Aave V3. It noted that Mantle Treasury will receive a yield on the loan.

The Mantle team wrote that the loan would convert idle treasury funds into a yield-generating credit asset and strengthen the relationship between Mantle and Aave, thereby accelerating Aave's deployment on the Mantle Network. Proceeds from the loan interest would also be directed to the treasury for Mantle (MNT) token burns or ecosystem funding, the proposal added.

"[This] demonstrates active treasury management and a proactive stance on industry resilience, reinforcing token holder confidence in Mantle’s long-term stewardship," the proposal said.

In detail, the proposal outlined an indicative interest rate of Lido staking APR plus a 1% premium, subject to final negotiation, with a maturity of up to 36 months. Early repayment would be permitted without penalty.

As risk protection measures, the proposal states that the loan would be secured via a multisig wallet designated by Mantle, over which it would hold a first-priority lien and security interest.

Aave will also need to deploy 5% of its revenue and Aave tokens worth at least $11 million to the wallet as collateral for the loan. In case of a default, Mantle noted that the loan is immediately due and payable.

Following the proposal, Bybit CEO Ben Zhou wrote that the crypto exchange will support the proposal. Bybit is a major supporter and strategic partner of Mantle Network.

"When we got hacked, the industry got together and helped us," Zhou wrote. "It is the only right thing that we do the same to [unite] together and walk out from difficult times."

The exploit

On April 18, a security breach in Kelp DAO’s LayerZero-powered cross-chain bridge led to the unauthorized minting of 116,500 rsETH tokens, valued at around $292 million, marking the largest DeFi exploit so far this year.

LayerZero reported that the attacker, likely North Korea's Lazarus Group, poisoned two RPC nodes on Kelp DAO and launched a DDoS attack to make the DVN accept a fake cross-chain message, leading it to sign an illegitimate transaction.

The attack's impact quickly spread to Aave when the exploiter supplied around $221 million in stolen rsETH as collateral on Aave V3 to borrow 82,650 WETH and 821 wstETH, creating significant bad debt for the protocol.

An Aave incident review earlier this week predicted two scenarios that would lead to around $124 million or $230 million in bad debt, respectively. 

Meanwhile, onchain analysts reported Thursday that the Kelp DAO attacker has now swapped all $175 million worth of stolen ETH into BTC through THORChain and other venues.

DeFi United

As the exploit spread to Aave and the wider DeFi sector, major industry players jumped in to mitigate the fallout.

On Tuesday, the Arbitrum Security Council froze 30,766 ETH held in an Arbitrum One address linked to the exploiter. Earlier today, Lido Labs posted a proposal to the DAO to allocate up to 2,500 staked Ethereum to reduce the overall rsETH shortfall, which would indirectly shrink Aave's exposure to bad debt.

Several DeFi players have rallied around "DeFi United," Aave's relief initiative to address the rsETH fallout. 

The EtherFi Foundation and Aave founder Stani Kulechov have each pledged 5,000 ETH to the relief effort. The Golem Foundation stated that it is contributing 1,000 ETH to DeFi United, while Frax Finance announced that it is working on its own contribution.