Aave Post-Mortem: How the $292M KelpDAO rsETH Exploit Shook DeFi Lending

October 28, 2026 MM Crypto Team

On April 18, 2026, an attacker exploited a weakness in the KelpDAO bridge and minted 116,500 unbacked rsETH, worth about $292 million and equal to about 18 percent of the token’s circulating supply. What followed was one of the most severe crises decentralized finance has ever faced. The stolen tokens were used as collateral on Aave V3, the largest lending protocol in DeFi, allowing the attacker to borrow approximately $236 million in WETH. When the rsETH turned out to be effectively unbacked, the collateral could not be liquidated, and Aave was left facing about $280 million in bad debt.

This is a post-mortem of that incident, published on October 28, 2026, drawing together the timeline, the containment measures, the recovery effort, and the lessons that the DeFi sector is still absorbing. The numbers alone make it one of the defining events of the year. AAVE, the protocol’s native token, fell about 26 percent over the weekend. Aave recorded around $9 billion in net outflows. Total value locked fell by more than a third, to about $17.5 billion. The ETH pool reached 100 percent utilization, leaving almost no ETH available for withdrawals. Across all decentralized lending protocols, total value locked fell by roughly $13 billion within 48 hours.

No single protocol failure explains a crisis of this scale. The KelpDAO exploit became a lending crisis because of the way DeFi protocols are connected to one another, and because of the assumptions that lenders make about the collateral they accept.

The Bridge Exploit

The attack began at the bridge. Chainalysis attributes the attacker to the DPRK-linked Lazarus Group, a hacking collective that has been linked to some of the largest crypto thefts in history. The specific vulnerability was a 1-of-1 LayerZero DVN on the KelpDAO bridge. A DVN, or Decentralized Verifier Network, is part of the infrastructure that verifies messages passing between blockchains. In a 1-of-1 configuration, a single verifier is responsible for confirming that a message is legitimate. If that single verifier is compromised or bypassed, the bridge will accept messages that should never have been trusted.

That is what happened here. The attacker exploited the single-verifier setup to mint 116,500 rsETH that had no backing at all. rsETH is KelpDAO’s liquid restaking token, a token that represents staked ETH that has been restaked through the EigenLayer ecosystem. Under normal circumstances, every rsETH in circulation is backed by ETH that has been staked. The attacker created tokens with no such backing, effectively printing $292 million out of nothing.

The choice of target was significant. Liquid restaking tokens had become one of the fastest-growing categories in DeFi by early 2026, and rsETH was widely accepted as collateral across lending protocols. The attacker did not need to sell the unbacked tokens on the open market, where a sudden flood of supply would have crashed the price and limited the damage they could extract. Instead, they took the tokens to Aave, where the protocol’s own lending mechanics would convert them into borrowable ETH.

From Bridge Exploit to Lending Crisis

The second stage of the attack was the part that turned a bridge exploit into a systemic crisis. The attacker deposited the unbacked rsETH as collateral on Aave V3 and borrowed approximately $236 million in WETH against it. This is how DeFi lending is supposed to work: a user deposits collateral, the protocol allows them to borrow a percentage of its value, and if the collateral’s price falls, the position is liquidated to protect the lenders.

But liquidation only works if the collateral has a real market value. The rsETH the attacker deposited was unbacked. Its price was a fiction maintained by the assumption that every token was backed by staked ETH. Once the exploit became known, that assumption collapsed, and the collateral became effectively unbacked. A position backed by worthless collateral cannot be liquidated in any meaningful sense, because there is nothing of value to sell. The borrowed WETH was gone, and the protocol was left holding the loss.

This is the mechanism by which Aave ended up facing about $280 million in bad debt. Bad debt in a lending protocol means that the value of the outstanding loans exceeds the value of the collateral backing them, and the shortfall falls on the protocol itself. In a traditional bank, bad debt is absorbed by the bank’s capital and, ultimately, by its shareholders. In DeFi, the question of who absorbs bad debt is more complicated, because the protocol is governed by token holders and the losses are spread across depositors and the protocol’s treasury.

The contagion spread beyond Aave. Across all decentralized lending protocols, total value locked fell by roughly $13 billion within 48 hours. The reason was straightforward. If Aave, the largest and most scrutinized lending protocol in DeFi, could be left holding $280 million in bad debt because of a flaw in a bridge it did not control, then every other lending protocol that accepted similar collateral faced the same question. Users withdrew first and asked questions later.

The Containment Response

The response to the exploit was fast, coordinated, and in many ways impressive. KelpDAO’s pauser multisig froze contracts 46 minutes after the attack began. That is a short window by the standards of DeFi incident response, where hours often pass before a team even realizes something has gone wrong. Aave, SparkLend and Fluid froze their rsETH markets. The Aave Protocol Guardian froze rsETH and wrsETH across Aave V3 by 19:00 UTC on April 18 and set the loan-to-value ratio to zero, preventing any further borrowing against the compromised collateral.

Kelp paused 43,373 rsETH, removing a significant portion of the unbacked supply from circulation. The Arbitrum Security Council froze 30,766 ETH linked to the attacker on April 21, three days after the incident. These freezes did not undo the damage, but they limited it. Every token that was frozen was a token that could not be used to borrow more funds or to be sold into the market.

The containment effort also revealed something important about the structure of DeFi. For all the rhetoric about decentralization and unstoppable code, the response to this crisis depended heavily on centralized emergency powers: multisignature wallets that could freeze contracts, a Protocol Guardian that could change risk parameters, and a Security Council that could freeze funds on a rollup. These mechanisms exist precisely because the industry has learned, through repeated experience, that a protocol with no ability to respond to an emergency is a protocol that will be drained completely when something goes wrong.

The tension is real. The same emergency powers that saved Aave from worse damage are the powers that critics of DeFi point to as evidence that the sector is not as decentralized as it claims. But the alternative, a protocol that cannot be paused or modified under any circumstances, is one that has no defence at all against an attack like this one. The industry has, in practice, chosen the middle path: protocols that are decentralized in normal operation but retain emergency controls for exceptional circumstances.

The Recovery Effort

Recovery from an exploit of this size is a long and partial process. The figures published in the post-mortem give a sense of both the scale of the effort and its limits. A total of 87,955 ETH was recoverable across Kelp’s claw-back, the Arbitrum freeze, and liquidations of the hacker’s positions. That recovery cut the 163,183 ETH shortfall to about 75,081 ETH. In other words, a little more than half of the shortfall was recovered, and a substantial gap remained.

DeFi United, a community-led recovery initiative, raised $221.65 million, equivalent to 100,338 ETH on-chain, across 69,299 wallets. The scale of participation is notable. Tens of thousands of wallets contributed to a recovery fund for a protocol they may never have used. That is a measure of how seriously the community took the crisis, and of how much was at stake for the reputation of DeFi lending as a whole.

The Aave DAO opened a proposal to add 25,000 ETH from its own treasury, a recognition that the protocol itself would need to absorb part of the loss. A Fluid-led consortium built an aWETH redemption protocol that processed $136 million in the first 48 hours, giving affected users a mechanism to recover some of their funds quickly.

These efforts matter, but they do not erase the loss. A shortfall of about 75,081 ETH remains, and the users who held rsETH or who had funds in the affected markets have borne real losses. The recovery also depended on the cooperation of multiple parties, including a rollup’s Security Council and a community fundraising effort, none of which could have been taken for granted in advance.

Frequently Asked Questions

What happened in the KelpDAO rsETH exploit?

On April 18, 2026, an attacker exploited a 1-of-1 LayerZero DVN on the KelpDAO bridge and minted 116,500 unbacked rsETH, worth about $292 million. The tokens were used as collateral on Aave V3 to borrow approximately $236 million in WETH, leaving Aave with about $280 million in bad debt.

Who was behind the attack?

Chainalysis attributes the attacker to the DPRK-linked Lazarus Group, a hacking collective linked to several of the largest crypto thefts in history.

How much bad debt did Aave face?

Aave faced about $280 million in bad debt, because the rsETH collateral backing the borrowed WETH was effectively unbacked and could not be liquidated.

How much of the loss was recovered?

A total of 87,955 ETH was recoverable through Kelp’s claw-back, the Arbitrum freeze, and liquidations of the hacker’s positions, cutting the 163,183 ETH shortfall to about 75,081 ETH. DeFi United raised $221.65 million across 69,299 wallets, and the Aave DAO proposed contributing 25,000 ETH from its treasury.

Source: Blockonomi

MM Crypto Analysis Web