Key Takeaways

  • Aave lost nearly $8 billion in total value locked over the weekend.

  • The decline followed a $293 million exploit involving Kelp DAO.

  • Hackers used stolen rsETH as collateral on Aave to borrow funds, creating roughly $195 million in bad debt.

  • Aave’s stablecoin pools are now fully utilized, limiting withdrawals.

Aave TVL Falls Sharply After Kelp DAO Exploit

Aave saw its total value locked fall from around $26.4 billion to $18.6 billion over the weekend after fallout from a major exploit tied to Kelp DAO.

The decline erased nearly $8 billion in TVL and caused Aave to lose its position as the largest DeFi protocol by locked assets.

Hackers Used Stolen rsETH as Collateral

The incident began after attackers stole approximately 116,500 rsETH tokens worth around $293 million from Kelp DAO’s LayerZero-powered bridge.

The hackers then deposited the stolen rsETH into Aave v3 as collateral and borrowed wrapped Ether.

This created an estimated $195 million in bad debt on Aave because the stolen collateral could no longer fully support the borrowed funds.



Stablecoin Pools Reach 100% Utilization

The exploit caused users to rush to withdraw assets from Aave, leading to severe liquidity pressure.

Aave v3 lending pools for USDT and USDC are now fully utilized, meaning more than $5.1 billion worth of stablecoins currently cannot be withdrawn until liquidity returns or borrowers repay loans.

The situation highlights how quickly problems in one DeFi protocol can spread across the broader ecosystem.

AAVE Token Falls Nearly 20%

The market reacted sharply to the incident.

Aave fell nearly 20% in just over 24 hours, dropping from around $112 to below $90.

Some of the largest withdrawals reportedly came from:

  • MEXC, which withdrew roughly $431 million

  • Abraxas Capital, which withdrew around $392 million

Multiple Protocols Pause rsETH and LayerZero Usage

Several projects connected to rsETH or the LayerZero bridge have temporarily paused use of the affected infrastructure.

These include:

  • Curve Finance

  • Ethena

  • BitGo

Aave also froze several rsETH markets across Aave v3 and v4 to prevent further suspicious borrowing.

Incident Tests Aave’s Security Model

The exploit is the first major test of Aave’s Umbrella security system, which was introduced in 2025 to help absorb bad debt and protect the protocol.

Despite the losses, Aave said rsETH on Ethereum mainnet remains fully backed by underlying assets.

The incident also comes shortly after Aave ended its relationship with Chaos Labs, one of its longest-serving DeFi risk providers.