Aave has frozen rsETH markets on V3 and V4 after a security incident tied to KelpDAO’s cross-chain bridge spilled into its lending pools. The problem, Aave said, did not come from its own contracts. On April 18, an attacker minted roughly 116,500 rsETH without backing, posted those tokens as collateral on Aave, and then borrowed more than 82,000 ETH and related assets across Ethereum and Arbitrum. Omer Goldberg said the total borrowed amount was above $200 million.
Because the collateral had no real value behind it, the positions could not be liquidated through the usual process. Aave moved to freeze all rsETH markets, stopping new deposits and blocking any new borrowing against the asset. Stani Kulechov said the protocol acted quickly to contain the exposure.
How unbacked rsETH turned into bad debt
The exploit started outside Aave, at KelpDAO’s bridge. After manipulating that system, the attacker created rsETH that was not backed by assets and used it as if it were valid collateral inside Aave. That made the borrowing look healthy on-chain at first glance. Once the borrowed ETH and other assets were removed, the protocol was left with liabilities that could not be recovered through liquidation.
Aave’s wETH pool is now estimated to carry about $177 million in bad debt. That has put loss allocation at the center of the response. Aave said it is reviewing borrowing activity linked to the incident. The report also noted that the protocol may turn to its Umbrella system, introduced in 2025, which can absorb deficits by slashing staked assets. The amount of coverage currently available has not been made clear.
Token price and liquidity both came under pressure
Market reaction was immediate. According to Lookonchain, AAVE fell by more than 18% during the day. Large holders sold tokens through multiple transactions, with some sales happening at average prices near $103. Other holders rotated out into ETH and WBTC.
Capital also moved out of the protocol. Total value locked dropped from $26.396 billion to $20.114 billion. One of the biggest withdrawals was about $431 million from MEXC, while other large wallets pulled more than $400 million in total. Those transfers showed a clear shift toward cutting exposure.
Markets are frozen, withdrawals remain open
Marc Zeller urged users to withdraw WETH from the affected pools. Aave later confirmed that withdrawals are still active even though rsETH markets have been frozen. On the other side of the incident, KelpDAO has paused its contracts and is continuing its investigation.
So far, the confirmed impact is clear: unbacked rsETH was used to secure borrowing, the resulting positions could not be liquidated, Aave pools were left with a large bad-debt gap, and the market responded with price losses and liquidity outflows. Aave has not yet given a definitive answer on who will ultimately absorb the loss or whether the coverage mechanism is sufficient to close the shortfall.