KelpDAO hack triggers $6B Aave TVL drop

TLDR

KelpDAOs rsETH bridge was exploited, and the attacker used the fake rsETH as collateral on Aave, creating large bad debt and triggering about a 6 billion dollar TVL outflow.

1. The attacker minted roughly 116,500 unbacked rsETH (about 292 to 294 million dollars) and deposited it on Aave V3 to borrow real ETH and WETH.
2. Aaves TVL dropped about 6 to 6.6 billion dollars, from roughly 26.4 billion to around 20 billion, and AAVE fell about 16 percent as users pulled funds and priced in bad debt risk.
3. The incident highlights structural risk from using liquid restaking tokens and bridged assets as collateral, so DeFi users now need to watch reserves, governance and any changes to collateral lists.

Deep Dive

1. How The KelpDAO Exploit Worked

KelpDAO is a liquid restaking protocol whose rsETH token is used across DeFi. On 18 April 2026, an attacker manipulated KelpDAOs LayerZero powered bridge and minted about 116,500 rsETH without backing, worth roughly 292 to 294 million dollars at the time.[^1]

Instead of cashing out immediately, the attacker deposited this unbacked rsETH into lending protocols, notably Aave V3, and borrowed large amounts of wrapped ether (WETH) and other assets.[^2] Once the bridge exploit was understood, rsETH was effectively no longer fully backed, so these positions could not be safely liquidated, turning into protocol level bad debt.

2. Why Aaves TVL Dropped 6 Billion Dollars

Because Aave had accepted rsETH as collateral, the exploit left Aave with roughly 177 to 196 million dollars of protocol specific bad debt concentrated in the rsETH WETH market on Ethereum.[^1][^3]

As risk became clear, depositors withdrew aggressively. Aaves total value locked fell from about 26.4 billion dollars to around 20 to 20.7 billion, a roughly 21 to 25 percent drop, which is the reported 6 to 6.6 billion dollar outflow.[^1][^3] The AAVE token itself dropped around 16 to 18 percent. Aave froze rsETH markets and emphasized that its core contracts were not directly hacked, but its Umbrella reserve may not fully cover the deficit, so stkAAVE holders could ultimately share losses.[^1]

3. Structural Risks And What To Watch Next

This incident exposes two linked structural risks in DeFi. First, liquid restaking tokens like rsETH are deeply integrated across lending markets, so a single bridge exploit can propagate bad collateral everywhere.[^2] Second, protocols that treat such assets as high quality collateral may underestimate the chance that a bridge or restaking layer fails.

Going forward, key things to monitor are: Aave governance discussions on how to socialize or absorb the bad debt, any changes to collateral lists and loan to value settings for LRTs and bridged assets, and whether other protocols disclose similar hidden exposures.[^1][^2] Users of Aaves WETH and rsETH pools, in particular, should watch official risk and governance channels for impairment updates.

Conclusion

The KelpDAO rsETH exploit did not directly hack Aaves core contracts, but it turned unbacked restaking collateral into real borrowings on Aave and then spooked depositors into pulling roughly 6 billion dollars of liquidity. The episode shows how bridge and restaking risks can cascade into flagship lending protocols, and it puts collateral design, reserve buffers and governance responses at the center of how markets will judge Aave and similar platforms from here.

[^1]: Aave TVL and bad debt figures from CoinDesks Aave hack coverage. [^2]: Cross protocol impact and exploit mechanics from CryptoBriefings KelpDAO post mortem. [^3]: TVL and bad debt range from a separate Aave TVL report.