Aave, the biggest lending platform in decentralized finance (DeFi), suffered one of its sharpest setbacks in years after a $292 million exploit at the restaking project Kelp DAO exposed cracks in how collateral moves across chains.
Attackers struck on April 18, draining 116,500 rsETH through a vulnerability in Kelp’s LayerZero-powered bridge. They forged cross-chain messages, then rushed the stolen, now-unbacked tokens onto Aave V3 as collateral to borrow wETH.
The result: roughly $196 million in bad debt that Aave cannot easily liquidate. The protocol swiftly froze rsETH markets and linked pairs to stop further damage.
The reaction was swift and brutal. In 48 hours, depositors pulled more than $8.45 billion from Aave. Its total value locked crashed from about $26.4 billion pre-hack to as low as $15.84 billion, according to DeFiLlama—a roughly one-third drop that briefly cost Aave its position as the largest DeFi protocol by TVL.
The pain did not stop at Aave’s doors. Total DeFi TVL slid from $99.5 billion to roughly $85.72 billion in the same two-day span, erasing more than $13 billion in locked capital. Other lenders felt the heat: Morpho shed about $1.7 billion in deposits, Sky lost roughly $600 million, and platforms including SparkLend, Fluid, Euler and Sentora posted double-digit percentage declines or froze rsETH exposure as a precaution.
Moreover, liquidity pools for wETH, USDT and USDC on Aave hit 100% utilization at points, briefly locking users out of withdrawals and spiking liquidations. At the time of publishing, roughly 65% of wETH remains borrowed ($5.61 billion of $8.65 billion) while its utilization seeing sharp spikes in the past few days.
The episode laid bare risks that have grown with liquid restaking tokens. rsETH had been deployed across dozens of platforms and more than 20 chains, creating dense layers of rehypothecation. When one bridge failed, fear rippled outward.
Following the protocol’s tumbling position, its native AAVE token fell as much as 26% before a partial rebound, while daily fees on the protocol jumped on heightened trading activity.
Aave’s governance and risk teams now face tough calls on absorbing the bad debt shortfall. Its insurance fund offers only partial cover, leaving open whether the DAO treasury or stkAAVE holders will shoulder losses. Kelp DAO has paused rsETH contracts network-wide while it weighs how to allocate the hit.
For a protocol long viewed as a cornerstone of DeFi lending, the speed of the outflow served as a warning: even battle-tested code can buckle when unbacked collateral from outside finds its way in. As markets stabilize near the $15.6–18 billion range for Aave, participants are taking a harder look at bridge security and collateral concentration across the wider ecosystem.
Also read: Justin Sun Sues Trump-Backed World Liberty Financial for Fraud and Token Seizure
