Joerg Hiller
Apr 22, 2026 15:00
A $293M exploit on Kelp DAO has triggered a $15B liquidity outflow from Aave, exposing vulnerabilities in DeFi lending protocols.
Aave, the leading decentralized lending protocol, has seen its deposit base shrink by $15 billion following a $293 million exploit on Kelp DAO. According to Aavescan data, the total value supplied to Aave plummeted from $45.8 billion on Saturday to $30.8 billion as of Wednesday.
The exploit targeted Kelp DAO’s LayerZero-powered rsETH bridge, draining 116,500 restaked Ether (rsETH). The attacker reportedly used some of the stolen funds to borrow from Aave, creating a ripple effect on the platform’s liquidity. Aave’s incident report revealed that 89,567 rsETH were deposited into the protocol, leaving a shortfall projected between $123 million and $230 million, depending on how losses are allocated.
Market participants are now concerned about a broader liquidity crunch in decentralized finance (DeFi), with the exploit exacerbating fears of systemic risks. Aave’s v3 Wrapped Ether (WETH) market hit 100% utilization temporarily, freezing liquidity for withdrawals, according to Talos, an institutional trading platform. This incident has prompted calls for more robust collateral frameworks to mitigate cascading risks in interconnected DeFi ecosystems.
Liquidity Shifts to Competitors
While Aave grapples with the fallout, other protocols are benefiting. SparkLend, the fourth-largest DeFi lending platform, has seen its total value locked (TVL) increase by $1.3 billion since the exploit, suggesting that capital is flowing to perceived safer venues.
Aave has taken steps to stabilize its markets, unfrozen WETH reserves on its Ethereum Core V3 platform, allowing users to deposit WETH once again. However, reserves remain frozen on other networks, including Arbitrum, Base, and Mantle, limiting liquidity options for users.
Decision Looms on Debt Allocation
How Aave addresses its bad debt could have far-reaching implications. The platform’s risk manager has outlined two scenarios. The first would distribute losses across all rsETH holders on Ethereum mainnet and layer-2s, leaving $123 million in bad debt. The second scenario shifts the burden entirely to layer-2 networks, increasing the shortfall to $230 million.
Prediction markets, such as Polymarket, are already seeing activity. Currently, 20% of traders are betting that Kelp DAO will socialize the losses across all rsETH holders, rather than isolating the impact on layer-2 users. The final decision could set a precedent for how DeFi platforms manage liability in future exploits.
This incident underscores the vulnerabilities in DeFi’s layered ecosystems, where exploits can cascade across platforms, amplifying their impact. For now, traders and investors are closely watching Aave’s next moves, as well as the broader implications for DeFi’s resilience.
Image source: Shutterstock