Aave (AAVE)

A hacker just stole $292 million from DeFi, and $Aave had absolutely nothing to do with it. But Aave is the one sitting on up to $230 million in bad debt right now. Here is exactly how that happened, and why it should change how you think about every DeFi protocol you are currently using. Kelp DAO issues rsETH, a liquid restaking token that represents real ETH deposited and staked through EigenLayer. Every rsETH is supposed to be backed one-to-one by real ETH sitting in a vault somewhere. That backing is the only reason lending protocols like Aave were willing to accept rsETH as collateral in the first place. To move rsETH between blockchains, Kelp used a LayerZero bridge. The bridge works by locking tokens on one chain and releasing an equivalent amount on the destination chain only after receiving a verified message confirming the lock happened. The attacker found a flaw in how Kelp verified those messages. By forging a single inbound packet on the Unichain-to-Ethereum route, the attacker convinced the bridge that 116,500 rsETH had been locked on the source chain when nothing had actually moved. The bridge released 116,500 rsETH on the Ethereum side anyway. Real ETH never moved. The liability just appeared from nothing, and Kelp’s total rsETH supply grew by 18% overnight with zero backing behind it. Then the attacker did something smart. They split the stolen rsETH across seven fresh wallets and deposited it all into Aave as collateral. Aave’s risk system saw rsETH, a known ETH-correlated asset, and allowed the attacker to borrow $190 million in wrapped ETH against it. Every line of Aave’s code executed exactly as it was designed to. The protocol had no way of knowing the collateral underneath was already worthless. By the time markets were frozen, the damage was done. Aave now faces two scenarios: 1) If Kelp spreads the losses across all rsETH holders, the token depegs roughly 15% and Aave absorbs around $124 million in bad debt. 2) If losses are isolated to Layer 2 networks, the damage rises to $230 million concentrated on Arbitrum, Mantle, and Base, with some pools facing haircuts above 70%. Users did not wait to find out which scenario plays out. $6.6 billion was withdrawn from Aave in hours, pushing WETH pools to 100% utilization and trapping depositors who could not exit their positions. Aave's treasury holds $181 million. The math is uncomfortably close. Here is the lesson that nobody in DeFi wants to say clearly: Your protocol can be perfectly audited, perfectly coded, and perfectly managed. But if it accepts collateral that moves through a bridge with a single point of verification failure, one forged packet on one route can make your collateral worthless before the next block is mined. Cumulative DeFi losses in 2026 have now crossed $480 million across 45 protocols. The Kelp exploit is the largest single event of the year. And it did not come from a smart contract bug. It came from a bridge, trusting a message it should not have trusted. Bridge security is the most important unsolved problem in DeFi right now. The market is not pricing that risk correctly. Screenshot this. Agree or cap? Follow me. I follow back if you also drop value fast. Try me

Wallet 0xc4683 is the 4th biggest borrower on Aave, looping USDe against USDT Currently earning -61.62% APY with a health factor of 1.01 https://t.co/WWaTkNeKq2

Day 3 update: TVL finally seems to be stabilizing, down only 7% after WETH withdrawals opened In total Aave v3 core instance lost 45% of its TVL as a result of the rsETH exploit ($21.5b -> $12b) Core markets like WETH, USDC and USDT still don't have liquidity for withdrawals https://t.co/P6oP30tnQY

💥 NEW: @aave’s TVL has dropped by over $10 billion following a bad debt incident triggered by a $290M+ $RSETH exploit on @KelpDAO. https://t.co/OQsXQ2SCaz

🚨 Aave's Core Markets Hit 100% Utilization According to a report from CoinDesk, security firm CertiK states the $AAVE lending protocol is in serious trouble. CEO Stani Kulechov told CoinDesk he does "not have anything useful to say."

Breaking: Aave's TVL fell by over $10 billion (≈¥1.6 trillion) after KelpDAO's ¥46 billion fund outflow event https://t.co/zYYrHLH62Q

🚨 UPDATE: SparkLend sees $1.4B inflows as Aave faces outflows after rsETH incident, per Blockworks Research. https://t.co/NJTJDoqiVC

ouch

since this happened, defi has lost 15% of it's tvl with aave losing 40% of theirs in the same timeframe how long before things return to normal