How to save $100 mln in 24 hours

DeFi works best when projects pull together.  Several protocols stepped in and built an emergency exit after the recent Aave situation.

A separate cross-chain exploit enabled unbacked borrowing on Aave, freezing its ETH market - but within hours, the 1inch team pulled an all-nighter, shipping emergency routing that helped unlock over $100 mln in stuck liquidity and gave users a way out to regain immediate liquidity and reduce exposure to liquidation risk.

On April 18, something unusual happened on the decentralized lending platform Aave. ETH utilization hit 100%. For thousands of lenders, withdrawals were no longer possible. Positions were effectively frozen, while liquidation risk continued to build in the background.

The attacker compromised two of LayerZero's internal RPC nodes and DDoS'd the external ones, forcing the DVN to rely solely on the poisoned infrastructure. The compromised nodes falsely reported that rsETH had been burned on the source chain. The DVN, seeing only that false data, confirmed the cross-chain message as valid - which caused Kelp's bridge escrow on Ethereum to release 116,500 rsETH that had no corresponding burn behind it. The attacker then used that rsETH as collateral on Aave to borrow real WETH, creating bad debt that cascaded through Aave's liquidity markets.

To some extent, that was a typical hack. What followed was less typical. Within hours, major projects in the DeFi ecosystem began to coordinate a response.

Building an exit in real time

As the largest single borrower on Aave - with $1.5 bln in ETH debt - the Fluid protocol had both exposure and capability. The team decided to act.

“We are a huge borrower on Aave,” said Samyak Jain, Founder & CTO at Fluid. “On one hand, it was a way to support Aave, its end users, and DeFi broadly - given the liquidation risk building across the protocol. On the other hand, it was also a way to unwind our borrow position. It was mutually beneficial for everyone.”

The solution was the aWETH Redemption Protocol - emergency infrastructure allowing users to swap frozen aWETH positions into liquid assets like wstETH or weETH, without leaving Aave.

It was built in less than 24 hours.

“The first night was monitoring the situation after the Kelp exploit hit Aave. The second night was when we actually built and shipped,” Samyak said. “We already had infrastructure in place… It was a full team effort, start to finish.

Collaboration under pressure

But building the protocol was only part of the solution. It needed liquidity. It needed routing. It needed execution.

That’s where the broader ecosystem stepped in.

1inch and other projects integrated with Fluid’s system to expand capacity and make exits accessible to users.

“1inch is always one of the first aggregators we reach out to - they move fast, we keep in constant communication, and that makes this collaboration seamless,” Samyak said.

From the 1inch side, the response was immediate.

On April 19 at 21:39 Dubai time, Fluid reached out with a plan. Within hours, documentation, contracts and integration guides followed. By early morning, the system was live.

“At 01:12 we deployed the first working version to staging,” said Kirill Kuznetcov, Senior Solution Architect at 1inch. “By 03:10 everything was in production and available to users,” 

The speed came down to infrastructure.

“Modular infrastructure allowed us to split the job in parallel,” Kirill explained, adding that price feeds, routing logic and swap execution were implemented simultaneously across the team. 1inch’s Pathfinder algorithm was updated to route through Fluid’s liquidity layer, enabling users to exit into any token.

Liquidity, unlocked

The impact of the aWETH Redemption Protocol was immediate.

In the first 24 hours:

• $135.75 mln in aWETH was processed
• 58,327.65 aWETH was converted into liquid collateral
• liquidation risk was reduced for thousands of users

More importantly, the system created choice where there had been none. Users could exit positions without waiting for utilization to drop - and without triggering cascading liquidations.

The infrastructure remains live, with deep liquidity still available.

Lessons under stress

For Fluid, the episode reinforced a familiar principle.

“Limits,” Samyak said. “Every major exploit follows the same pattern - protocols without proper caps and constraints get exposed.”

He points to borrowing caps, withdrawal limits and exposure controls as foundational, not optional.

At 1inch, the takeaway is more cautious, but equally clear.

“You shouldn’t create Aave markets with assets tied to bridges that require participation from validators,” Kirill said. “There’s a risk they get compromised, tokens get minted out of thin air, deposited as collateral, and create bad debt.”

“If such bridges are used, you shouldn’t rely on a single DVN signer,” he added. “At least three geographically distributed validators should be required. That should be mandatory for any bridged asset.”

A different kind of response

What stood out in this episode wasn’t just the exploit or vulnerability, but the response to it. 1inch and Fluid aligned within hours to find a solution. At the same time, the industry rallied around Aave through the DeFi United initiative, with support from major projects helping to cover the bad debt. 

In just one night:

• Fluid built the core mechanism
• 1inch enabled routing and execution
• liquidity providers expanded capacity

Not through formal coordination, but through shared incentives.

The result wasn’t a fix to the exploit itself. It was something else: a real solution for affected users. Currently, WETH markets on Aave remain at 100% utilization and users’ assets are still locked. DeFi United has published a recovery plan. 

In DeFi, where systems are permissionless and risks are real-time, that may matter just as much.

Let’s keep uniting DeFi with 1inch, Fluid and other projects!