.png){kind=logo}
The risk management structure of Aave is strained following a notable exploit by Kelp DAO that revealed weaknesses in the interwoven systems of DeFi. The event that cost the theft of around $293 million in value of rsETH has caused concerns about systemic risk in lending protocols.
This attack was a result of a bug in the LayerZero bridge of Kelp DAO, which allowed the hacker to mint 116,500 tokens in the form of rsETH and use them as collateral on the Aave V3 to borrow wrapped Ethereum (wETH). This caused unsecured positions and led to liquidity stress.
LlamaRisk notes that the incident highlights that a single bridge exploit can trigger liquidity crunches and mass withdrawals across interconnected protocols. After the exploit, Aave saw almost $10 billion worth of value leave the site and it was a strong indicator of a drop in user trust.
LlamaRisk analysis indicated that there are two possible scenarios that may play out based on the distribution of the losses. In the former, the bad debt is distributed among all holders of rsETH on Ethereum mainnet and Layer 2 networks, causing the bad debt to reach about $123.7 million and a possible 15% depeg of rsETH against ETH.
The second case transfers the total liability to Layer 2 ecosystems like Arbitrum and Mantle and the bad debt is notably high, at approximately $230.1 million. The report noted that Aave had around $181 million in its treasury that would partially cover losses.
The attack caused excessive liquidity pressure in Aave. Based on market data, there were more than $5.4 billion of ETH withdrawals as users scrambled to sell positions, pushing liquidity usage near 100%.
As a reaction, Aave froze rsETH markets and could use its Umbrella security model to cover losses in wETH, noting that 18,922 Aave Wrapped ETH (aWETH) tokens worth nearly $43.7 million have entered the unstaking cooldown phase.
Governance actions contributed to the escalation of risk, including raising the loan-to-value (LTV) ratio to 93%, which erased safety margins and left the protocol vulnerable as collateral fell.
Also Read: Kelp DAO Hack Drains $293 Million and Triggers DeFi Contagion Fears
The event has spurred questions on cross-chain infrastructure and systemic dependencies in DeFi. StockTwits analysis notes that bridge failures can quickly spread into systemic liquidity crises in decentralized lending markets.
Kelp DAO has paused impacted contracts and is working with Aave and LayerZero, among other stakeholders, to review the impact and identify recovery measures.
The exploit is being considered one of the biggest DeFi stress tests of 2026. Robust risk management and more conservative collateral structures are required to tackle this.
