Aave, one of DeFi's largest lending protocols, is grappling with a severe liquidity crisis after an exploit of KelpDAO's rsETH bridge on April 18, 2026. Attackers siphoned 116,500 rsETH (valued at an estimated $177 million to $200 million), deposited them on Aave V3 as collateral, and borrowed wrapped ether (WETH). The incident pushed Aave's WETH pool utilization to 100%, triggering a massive wave of withdrawals that slashed total value locked (TVL) by 24.11% within hours. The AAVE token plummeted 17.7% on April 19 as markets priced in bad debt uncertainty.
How the Exploit Unfolded
The attackers exploited a vulnerability in KelpDAO's bridge contract for rsETH, a liquid restaking token. After stealing the tokens, they used them as collateral on Aave V3 to borrow WETH. When KelpDAO paused rsETH contracts in response, the collateral backing those borrow positions became effectively worthless, leaving Aave with an estimated $177 million to $200 million in bad debt across its WETH reserves. Smaller exposures on Compound and Euler may push the total closer to $200 million.
Aave confirmed its own contracts were not exploited. "Aave's contracts have not been exploited," the project's X account stated, describing the event as an issue tied to rsETH. The team immediately froze rsETH markets on Aave V3 and V4, removed borrowing power against that collateral, and set loan-to-value ratios to zero in affected deployments. Aave founder Stani Kulechov noted, "rsETH has been frozen on Aave V3 and V4, the asset does not have any borrowing power as a measure due to KelpDAO bridge exploit that happened outside of Aave."
Withdrawal Wave and Liquidity Freeze
The freeze on rsETH did not stop users from trying to exit the protocol entirely. Fear of bad debt spillover set off a wave of outflows that hit Aave's ETH and WETH pools hard. Reports indicate that over $5.4 billion in ETH and WETH was withdrawn within hours. As capital drained out, utilization in the WETH market climbed to 100%. At that level, no liquidity remains in the pool for suppliers to redeem against, effectively halting withdrawals.
Stablecoin pools such as USDC and USDT also felt pressure. Although they had no direct rsETH exposure, the broader exit pushed utilization to high levels on certain deployments, with users reporting failed or delayed withdrawals as available liquidity thinned. Aave's TVL dropped from approximately $26.4 billion to $19.776 billion, a 24.11% decline per Defillama data as of April 19. The AAVE token fell 17.7% on the same day, reflecting concerns over potential slashing if the Umbrella mechanism is activated.
Umbrella Backstop and Next Steps
Aave's Umbrella system is the protocol's built-in backstop for bad debt events. If confirmed, the mechanism can draw on reserves and, depending on the situation, may involve slashing staked AAVE to cover the deficit. The precise impact on depositors is still being determined. Other protocols sharing overlapping liquidity, such as Sparklend, reported rate spikes and temporary pauses as capital shifted away from affected markets.
As of April 19, no further exploits or expansions have been reported. WETH pool utilization remains elevated. Full withdrawal access depends on either panic subsiding organically or the Umbrella mechanism settling the bad debt and restoring confidence in the reserves. Aave is expected to complete a formal bad debt review, issue an Umbrella resolution, and monitor whether outflows stabilize as markets absorb the full implications of the KelpDAO incident.
Broader Implications for DeFi
This event underscores the systemic risks in DeFi's interconnected ecosystem. A vulnerability in a third-party bridge can propagate through collateral chains to affect a major lending protocol, causing cascading liquidity crises. The industry will closely watch how Aave's Umbrella performs under stress and whether this incident prompts stronger cross-protocol risk isolation measures. For now, Aave users face significant uncertainty as the protocol works to restore normalcy.