Share
On April 18, Aave’s Guardian system detected a potential exploit involving rsETH, a liquid restaking token issued by Kelp DAO. Within hours, the protocol froze rsETH and its wrapped variant across all deployments, set loan-to-value ratios to zero, and halted new borrowing against the asset.
The decision was a containment move, not evidence that Aave’s own lending contracts had been breached, but in decentralized finance, perception moves faster than nuance. Users interpreted the freeze as a systemic risk signal and began withdrawing at scale.
The root cause was a sophisticated attack on the cross-chain infrastructure bridging rsETH between networks. Exploiting weaknesses in how Kelp verified messages via LayerZero, the attacker forged a transfer that caused the bridge to release approximately 116,500 rsETH from the Ethereum-side vault without any corresponding tokens being locked.
The newly minted, unbacked tokens were then deposited into Aave as collateral to borrow roughly $190 million in ETH and related assets across Ethereum and Arbitrum, leaving the protocol holding collateral whose true backing had become deeply uncertain.
On-chain data tracked by analyst EmberCN shows total deposits on Aave fell from $48.5 billion before the incident to $30.7 billion, an outflow of $15.1 billion over approximately three and a half days. That represents roughly one-third of the platform’s capital base evaporating in under a week. The pace of withdrawal bore the hallmarks of a classic liquidity run: large players, including prominent wallets linked to Justin Sun, moved early and moved fast, accelerating the exit and tightening available liquidity for those still inside the protocol.
Aave Sees $15.1 Billion Outflow; Some Withdrawn Funds Shift to Spark
According to @EmberCN, funds continue to flow out of Aave, with $15.1 billion leaving the platform in three and a half days. Total deposits dropped from $48.5 billion before the incident to the current $30.7… pic.twitter.com/5rjAhqRMXO
— Wu Blockchain (@WuBlockchain) April 22, 2026
Aave’s governance forum documented the feedback loop in real time. As suppliers withdrew, the liquidity pool shrank, raising each remaining depositor’s proportional exposure to the potential bad debt. That dynamic created pressure on further withdrawals rather than containing them, a concern governance participants raised directly after the protocol unfroze its main WETH reserves on Ethereum.
Aave’s incident report, co-authored by Aave Labs and risk service provider LlamaRisk, identified two scenarios for total losses. If the shortfall from the exploit is distributed across all rsETH holders, the token faces an estimated 15% depeg, translating to roughly $124 million in bad debt on Aave. If losses are instead concentrated on layer-2 networks such as Arbitrum and Mantle, where the bridged tokens were most actively used, bad debt could climb to approximately $230 million.
The final figure depends on decisions Kelp DAO has not yet made publicly about how it will allocate the loss. Aave noted its DAO treasury holds around $181 million in assets, and discussions with ecosystem stakeholders about covering any deficit are ongoing.
The fallout was not limited to Aave. Morpho, a rival lending protocol, saw total deposits decline from $11.7 billion before the rsETH incident to $10.2 billion, shedding $1.5 billion as users reduced exposure across DeFi lending broadly. The shared collateral assumptions that underpin much of the sector meant no major platform was fully insulated from the confidence shock.
Spark told a different story. SparkLend, the lending arm of the Sky ecosystem and a protocol that does not use rsETH as collateral, saw its total value locked rise from $1.9 billion to $3.2 billion during the same window, absorbing $1.3 billion in net inflows. The divergence suggests at least a portion of capital leaving Aave was not exiting DeFi entirely but rotating toward platforms perceived as carrying less cross-chain collateral risk in the immediate aftermath of the incident.
The episode has renewed scrutiny of the restaking model and the infrastructure assumptions it relies on. Aave had approved an increase to its rsETH supply cap as recently as April 9, citing persistent demand for ETH-correlated leverage strategies. Risk analysts noted after the incident that price correlation between rsETH and ETH is not the same as infrastructure safety.
A collateral asset can appear liquid, price-stable, and well-integrated while still carrying a hidden bridge and minting risk that the lending protocol itself cannot observe or control. When that external layer fails, the lending platform inherits the consequences directly. With DeFi losses in 2026 already exceeding one billion dollars across multiple exploits, pressure on protocols to scrutinize collateral provenance rather than just price behavior is intensifying.
Share
preferred on
