DeFi lender pauses buybacks after exploit losses

TLDR

Aave (AAVE) is moving to pause its token buyback program after large second order losses tied to the rsETH/KelpDAO exploit.

1. Aave governance is voting to suspend AAVE treasury buybacks until fallout from the rsETH bridge exploit is fully resolved, formalizing a halt already in place.
2. The exploit pushed unbacked rsETH into Aave and other lenders, creating roughly $246 million in bad debt and contributing to a sharp drop in Aaves total value locked.
3. A coordinated DeFi recovery effort aims to restore rsETH backing without socializing losses, and the buyback pause will likely stay until that plan is executed and risks are clearer.

Deep Dive

1. What Aave Is Pausing And Why

A new Aave maker/">DAO proposal asks to pause AAVE token buybacks from the protocol treasury until the rsETH/KelpDAO situation is resolved, extending a de facto pause that has been in place since April 19. The proposal argues that using revenue for buybacks while the final size and allocation of losses is uncertain would weaken the treasurys ability to participate in any coordinated response. This follows the rsETH bridge exploit on April 18, where forged messages allowed 116,500 unbacked rsETH to be minted and then used across Aave V3 markets, prompting freezes of rsETH markets on several chains and a governance scramble.

2. Scale Of The Exploit Fallout

The KelpDAO rsETH incident is one of the largest DeFi hacks of 2026, with reports estimating around $292 to $293 million exploited via the bridge and over $620 million lost across April exploits overall. A large share of the unbacked rsETH ended up as collateral on Aave and Compound, leaving the two lenders with roughly $246 million in bad debt according to a joint plan described by DeFi United and covered by outlets such as Yahoo Finance. Analytics cited by coverage of Aaves situation note that Aaves total value locked dropped from about $26.4 billion to around $18.6 billion after the incident, an almost $8 billion reduction in deposits.

3. Recovery Plan And What To Watch

A cross protocol coalition called DeFi United has published a technical implementation to restore full backing for rsETH and clean up the bad debt on Aave and Compound. The plan involves:

1. Converting committed ETH into rsETH in tranches and depositing it into the bridge lockbox to re collateralize rsETH.
2. Temporarily adjusting the rsETH oracle price via governance votes so that the attackers positions on Aave and Compound can be liquidated and the underlying ETH recovered.
3. Unfreezing affected markets once backing and positions are restored, aiming to avoid socialized losses for users.

Aaves buybacks are likely to remain paused until these steps are live, governance votes on Ethereum and Arbitrum pass, and the risk of further interference by the exploiter is reduced.

Conclusion

Aaves move to pause buybacks after the rsETH exploit is a defensive choice to prioritize treasury strength and recovery over near term tokenholder rewards. The outcome will hinge on whether the DeFi United recovery plan successfully restores rsETH backing and clears bad debt without socializing losses, which would both stabilize Aave and set a precedent for how large DeFi lenders handle future bridge failures.