What happened in the Aave and Kelp DAO exploit?

Hackers stole 116,500 rsETH tokens worth about $293 million from Kelp DAO and used them as collateral on Aave to borrow wrapped Ether. This created bad debt risk on Aave when the collateral became compromised. The incident triggered liquidity stress and large withdrawals from the platform.

How much bad debt could Aave face after the Kelp exploit?

Aave’s risk manager outlined two scenarios, with bad debt ranging from $123.7 million to $230.1 million. The final outcome depends on how losses are distributed across Ethereum mainnet and layer 2 networks. This makes it a significant but still uncertain financial hit.

Why did Aave users withdraw nearly $10 billion after the exploit?

The exploit increased fears of insolvency or liquidity issues within Aave. Because DeFi protocols are interconnected, users often withdraw funds quickly to avoid exposure to cascading losses. This behaviour is common during high-risk events in crypto markets.

What is rsETH and why is it important in this exploit?

rsETH is a restaked version of Ether used as collateral in DeFi protocols like Aave. Its value depends on maintaining a peg to ETH. The exploit risks breaking that peg, which would reduce collateral value and increase bad debt.

What is the difference between the two Aave bad debt scenarios?

The first scenario spreads losses across all networks, resulting in lower bad debt but risking a 15% depeg in rsETH. The second concentrates losses on layer 2 networks like Arbitrum and Mantle, leading to higher bad debt but protecting Ethereum mainnet. Each option involves trade-offs between systemic stability and loss size.

How risky is a 15% depeg in rsETH for investors?

A 15% depeg means rsETH could trade significantly below ETH, reducing the value of collateral backing loans. This can trigger liquidations and further losses across DeFi platforms. It is a high-risk scenario, especially for leveraged users.

How can Aave cover the potential losses?

Aave may use its Umbrella security model and tap its treasury, which holds around $181 million. This could help absorb part of the bad debt and stabilise the protocol. However, it may not fully cover the worst-case scenario.

What does this exploit reveal about DeFi risks?

The incident highlights contagion risk, where one exploit can spread across multiple protocols. It shows how collateral reuse and cross-chain systems increase systemic vulnerability. Even well-established platforms like Aave are exposed to external failures.

Aave models $230M Kelp exploit fallout

Written by Jon CuthbertPublished Apr. 21 2026Last Updated Apr. 21 2026

Aave’s risk manager has outlined two potential bad debt scenarios following the Kelp DAO exploit, with losses ranging from $123.7 million to $230.1 million depending on how they are distributed.

The incident began after attackers stole 116,500 rsETH tokens worth $293 million and used them as collateral on Aave to borrow wrapped Ether, triggering liquidity stress across the protocol.

The fallout has already driven nearly $10 billion in withdrawals from Aave, underscoring how a single exploit can cascade through decentralised finance systems.

Under the first scenario, losses would be spread across Ethereum mainnet and layer 2 networks, resulting in lower bad debt but risking a 15% depeg in rsETH relative to Ether.

The second scenario concentrates losses on layer 2 networks such as Arbitrum and Mantle, increasing bad debt but better protecting the mainnet ecosystem.

LlamaRisk said Aave could also deploy its Umbrella security model and tap its roughly $181 million treasury to help absorb potential losses.

Kelp DAO said it is still assessing the exploit, which involved compromised nodes on a LayerZero bridge, while working with partners to determine the best recovery path.

At the time of reporting, Aave price was $92.92.