TLDR
A KelpDAO rsETH exploit pushed Aaves ETH lending utilization to 100%, briefly locking withdrawals and stressing Ethereum DeFi.
- An attacker minted unbacked rsETH via a cross-chain bug, deposited it on lending protocols, and borrowed large amounts of ETH, creating hundreds of millions in bad debt.
- On Aave (AAVE), ETH pools hit 100% utilization, over $5.4 billion of ETH was pulled, borrowing rates spiked, and AAVEs price dropped more than 20 percent in the fallout.
- The key questions now are how bad debt is resolved, how quickly utilization normalizes, and whether cross-chain security and collateral rules tighten across Ethereum DeFi.
Deep Dive
1. Exploit Mechanics And Size
KelpDAO, a liquid restaking protocol, suffered an exploit where a flaw in its rsETH cross-chain infrastructure allowed the attacker to mint roughly 116,500 rsETH without real backing, worth around $290 million at the time. Reports tie the root cause to a vulnerability in LayerZeros messaging layer, enabling a spoofed transfer that bypassed proper verification on KelpDAOs bridge contracts.
The attacker funneled this unbacked rsETH into lending markets like Aave V3, Compound, Euler and others, using it as collateral to borrow large amounts of ETH and WETH, generating hundreds of millions in effective bad debt across protocols.
A single faulty bridge design let one asset go fractional against the rest of DeFi, turning protocol composability into a contagion channel.
2. How ETH Utilization Spiked
On Aave, the attackers positions and rapidly shifting risk triggered a rush by large depositors to pull ETH. One report notes that over $5.4 billion worth of ETH was withdrawn within hours, including a single 65,584 ETH withdrawal by Justin Sun, pushing the ETH pool to 100 percent utilization.
In lending terms, utilization is the share of supplied assets that are borrowed; at 100 percent, there is effectively no idle liquidity, so remaining depositors cannot withdraw and interest rates jump sharply as the rate curve penalizes high utilization. AAVEs own token price dropped sharply as markets priced in potential bad debt and protocol risk.
3. What To Watch Next
Several defenses are already in place: Aave has frozen rsETH markets, reduced ETH loan-to-value to zero for some exposures, and stated that core Aave contracts were not exploited, limiting the damage to markets referencing rsETH.
Going forward, three things matter for ETH lenders and DeFi users:
- Whether and how any bad debt is socialized or repaid.
- How quickly Aaves ETH utilization drops back from 100 percent as confidence returns.
- Whether cross-chain providers and protocols harden settings, for example by avoiding 1-of-1 validator assumptions for bridges and tightening collateral whitelists.
If utilization and rates normalize and bad debt is contained, this could remain a localized scare; if not, it reinforces a regime where cross-chain collateral is treated as structurally higher risk.
Conclusion
A cross-chain bug at KelpDAO cascaded into Ethereum lending markets by letting unbacked rsETH be used as collateral, driving Aaves ETH utilization to 100 percent and briefly freezing withdrawals.
The response from Aave and other protocols, plus any structural changes to bridge security and collateral standards, will determine whether this is remembered as a one-off shock or a turning point in how DeFi handles integrated restaking assets.
CoinsKid.Com