DeFi lenders see $6B withdrawals after hack

TLDR

DeFi lending platforms have seen roughly $6 billion withdrawn after a major cross-chain exploit involving Kelp DAO's rsETH triggered a liquidity run, especially on Aave.

1. Attackers exploited Kelp DAOs rsETH bridge, then used the stolen tokens as collateral on Aave and other lenders, creating hundreds of millions in bad debt.
2. Aaves total value locked dropped about $6-6.6 billion in under two days, with some pools hitting 100% utilization and lenders temporarily unable to withdraw.
3. The focus now is on how Aaves backstops, Kelp/LayerZero fixes, and broader DeFi risk models handle liquid restaking and cross-chain collateral after this shock.

Deep Dive

1. How The Hack Hit DeFi Lenders

Kelp DAOs rsETH, a liquid restaking token, was drained via a bug in its LayerZero-based cross-chain bridge, allowing an attacker to mint roughly $291-293 million of unbacked rsETH. Reports detail that 116,500 rsETH were created and then deposited as collateral on Aave V3 and other protocols to borrow real assets like wrapped ETH and stablecoins, leaving lenders with unbacked loans and around $177-200 million of bad debt on Aave alone.

Although Aaves own smart contracts were not exploited, accepting rsETH as safe collateral meant the bridge failure upstream still translated into protocol-level losses and forced emergency risk controls.

2. Scale Of Withdrawals And Liquidity Stress

Aave, the largest DeFi lender, saw its TVL fall from about $26.4 billion to roughly $20 billion, a drop of around $6-6.6 billion as whales and institutions rushed to exit after the exploit. One analysis cites about $6.2 billion in net withdrawals, with the main WETH pool hitting 100% utilization, meaning depositors effectively could not withdraw until liquidity returned.

Data providers and media note that withdrawals also spread to other lenders such as Compound, Morpho and Spark, though on a smaller scale, as users de-risked exposure to any market touching rsETH or similar assets.

3. What To Watch Next For DeFi

Aave is relying on its Umbrella backstop system and reserves to address the estimated $177-196 million deficit, and may need to socialize losses via staked AAVE, according to detailed coverage of the withdrawal crisis and bad debt. Governance decisions on how to handle that hole will be a key test of market confidence.

At the same time, Kelp DAO and LayerZero are investigating and patching the rsETH bridge design, while developers across DeFi warn that liquid restaking tokens and modular cross-chain setups need stricter security floors. Coverage of the wider fallout notes withdrawals across multiple lending protocols as users reassess bridge and LRT risk.

Confidence: high because multiple independent analytics and news outlets report consistent figures for both the exploit size and the roughly $6 billion-plus Aave outflows.

Conclusion

A single cross-chain exploit in Kelp DAOs rsETH bridge cascaded into billions of dollars leaving Aave and other DeFi lenders, even though their core contracts were not directly hacked. The episode underlines that the biggest risk for DeFi lenders is often not their own code, but the complex, composable collateral they accept, especially bridges and liquid restaking tokens. Going forward, how quickly protocols tighten collateral standards and how credibly Aave resolves its bad debt will shape whether confidence returns or more capital exits DeFi lending.