The incident, which occurred on April 18, 2026, saw attackers leverage $292 million (around £235 million) worth of stolen rsETH from Kelp's bridge. This compromised digital asset was then used as collateral on Aave V3 to borrow wrapped ether (WETH), ultimately leaving Aave grappling with an estimated $196 million (approximately £158 million) in sector-specific bad debt. This bad debt is predominantly concentrated in the rsETH–WETH pair on the Ethereum network.
Crucially, Aave's own smart contracts remained uncompromised during the attack. However, the protocol's TVL dramatically fell from $26.4 billion to nearly $20 billion over the weekend, according to data from DefiLlama. The AAVE token reacted sharply, dropping to $92, while daily fees escalated to $1.99 million as liquidations intensified across the market.
Depositors have been withdrawing their funds swiftly, indicating a lack of confidence as Aave faces a substantial financial hole it did not directly create. The attackers' modus operandi involved draining 116,500 rsETH from Kelp's bridge. These stolen tokens were then deposited as collateral on Aave V3, enabling the perpetrators to borrow wrapped ether against them. On-chain trackers estimate that the Aave-specific borrow amounted to approximately $196 million, with total positions spanning across Aave, Compound, and Euler reaching around $236 million.
Aave operates as the largest lending protocol in the DeFi ecosystem, allowing users to earn yield by depositing crypto and facilitating borrowing against collateral. Kelp, a liquid restaking protocol, takes staked Ethereum and channels it through EigenLayer, a separate yield-generating system. In return, Kelp issues rsETH, a receipt token that can be traded and, critically, used as collateral on platforms like Aave.
The exploit on Saturday saw attackers tricking Kelp's cross-chain bridge into releasing 116,500 rsETH, valued at approximately $292 million, to a controlled address. This stolen rsETH was then deposited onto Aave V3 as collateral, against which wrapped ether was borrowed. A blockchain bridge typically facilitates the transfer of tokens between different networks.
Initially, Aave stated that its Umbrella reserve would cover any deficit. However, this stance subsequently softened, with the protocol indicating it would “explore paths to offset the deficit.” The concentration of the damage is significant because, while Aave's loan book spans 22 chains, Ethereum alone accounts for $14.24 billion of the $17.82 billion in outstanding borrows. Furthermore, WETH comprises 39.49% of all loans on the protocol, highlighting the system's susceptibility to such a targeted attack.
