A wallet linked to blockchain entrepreneur Justin Sun has withdrawn 274 million USDT from the Aave lending protocol, just 21 minutes after Aave froze its rsETH and wrsETH markets in response to the KelpDAO exploit on April 18, 2026. The rapid exit has reignited scrutiny over large DeFi position management and potential informational advantages.
KelpDAO Exploit and Aave's Emergency Freeze
On April 18, the KelpDAO protocol suffered a $292 million exploit due to a vulnerability in the Layerzero cross-chain bridge. The attacker used stolen rsETH tokens as collateral on Aave to borrow ETH, prompting Aave to freeze the affected markets at 18:52 UTC as a containment measure. The freeze effectively halted rsETH withdrawals and borrowing, but left existing positions in a precarious state.
According to data from Wu Blockchain, the HTX Recovery address — a wallet previously associated with Sun's exchange HTX — initiated a withdrawal of 274 million USDT between 19:12 and 19:17 UTC, a five-minute window that analysts say suggests pre-positioned transactions or automated triggers. The timing, just 21 minutes after the freeze, raises questions about how quickly large players can react to protocol-level events.
Market Impact and Whale Exodus
In the 24 hours following the exploit, whales pulled over $5.4 billion from Aave, pushing the protocol's ETH utilization rate to 100% and effectively locking depositor funds. The incident left Aave facing between $177 million and $200 million in bad debt, according to risk service provider Llamarisk. AAVE's token price dropped 17.7% as panic spread across DeFi markets.
The 274 million USDT withdrawal was one of the largest single outflows from Aave during the crisis. Sun has not issued a public statement, but this is not the first time wallets linked to him have moved large positions during market stress. In March 2023, during the Silicon Valley Bank de-pegging event, similar addresses withdrew significant USDC and DAI from Aave, drawing community criticism.
DeFi Risk Management Under Scrutiny
On-chain analysts emphasize that the 21-minute gap between the freeze and the withdrawal is remarkably short, indicating either advanced monitoring systems or automated risk controls. However, the episode also highlights the potential for large holders to front-run or capitalize on internal knowledge, especially in permissionless protocols where transaction ordering is visible on-chain.
Aave's risk team has published a formal incident report outlining possible scenarios for unrecoverable claims for rsETH depositors. The broader DeFi ecosystem now faces renewed calls for better oracle mechanisms, faster circuit breakers, and improved transparency around large wallet movements. As the investigation continues, the KelpDAO exploit and its aftermath serve as a stark reminder of the interconnected risks in decentralized finance.