Kelp DAO Bridge Exploit Results in $293M Mint, Leaves Aave With Over $200M in Bad Debt

Gate News message, April 19 — On April 18 at 17:35 UTC, an attacker exploited a vulnerability in Kelp DAO's LayerZero-powered cross-chain bridge, releasing 116,500 rsETH (approximately $293 million and roughly 18% of the token's circulating supply) to an attacker-controlled wallet without corresponding ETH being locked. The attacker then deposited the unbacked rsETH into Aave V3 and V4 as collateral, borrowing real wrapped ether (WETH) against it. By the time Kelp's emergency multisig froze the protocol 46 minutes later, the WETH had been withdrawn.

The bridge vulnerability allowed the attacker to submit a crafted message that passed verification checks despite no actual deposit on the source chain. Two follow-up attempts at 18:26 and 18:28 UTC to drain an additional 40,000 rsETH each were reverted after the pause was activated.

Aave now carries between $177 million and $236 million in bad debt, concentrated in the rsETH/WETH pair on Ethereum. The platform's total value locked (TVL) dropped approximately $6 billion, WETH market utilization hit 100% (preventing further withdrawals), and AAVE token declined over 18%. Aave's Umbrella insurance fund holds about $50 million, leaving a significant gap. The borrow positions are effectively unliquidatable as rsETH collateral cannot be redeemed and will not trade near peg once the unbacked supply is fully recognized.

SparkLend, Fluid, and Upshift paused or froze rsETH within hours; Morpho's isolated market architecture limited exposure to approximately $1 million across two markets. rsETH across 20-plus chains now faces backing uncertainty until Kelp publishes a reconciliation of reserves against outstanding supply. This exploit marks the largest DeFi incident of 2026, with cumulative DeFi losses for the year reaching between $450 million and $482 million across roughly 45 protocols.