On April 18, 2026, a critical vulnerability in KelpDAO's rsETH cross-chain bridge was exploited, allowing attackers to siphon 116,500 rsETH tokens. The stolen assets were promptly deposited as collateral on Aave V3, with the attacker borrowing large amounts of Wrapped Ether (WETH) against them. The incident has left Aave grappling with an estimated $177 million to $200 million in bad debt, triggering a severe liquidity crisis across the protocol.
Event Overview and Aave's Response
After the exploit, KelpDAO paused its rsETH contracts, rendering the deposited collateral worthless and making the corresponding loans effectively unliquidatable. This created a massive bad debt hole in Aave's WETH reserves. Estimates suggest total borrowed value across Aave and smaller exposures on Compound and Euler could reach $200 million or more.
Aave quickly clarified that its own smart contracts were not compromised. “Aave’s contracts have not been exploited,” the project stated on X, describing the issue as external and tied to rsETH. The team froze all rsETH markets on Aave V3 and V4, removed borrowing power against that collateral, and set loan-to-value ratios to zero in affected deployments. Aave founder Stani Kulechov confirmed: “rsETH has been frozen on Aave V3 and V4, the asset does not have any borrowing power as a measure due to KelpDAO bridge exploit that happened outside of Aave. Both Aave V3 and V4 does not have further exposure to rsETH.”
Liquidity Crisis Unfolds
While the freeze prevented new rsETH activity, it could not stop users from withdrawing funds en masse. Fear of bad debt contagion sparked a wave of withdrawals that hit Aave’s ETH and WETH pools with unprecedented force. Within hours, outflows from ETH and WETH reached $5.4 billion. As capital drained, the WETH market pool utilization climbed to 100%, meaning all available liquidity had been borrowed and no funds remained for suppliers to redeem.
At 100% utilization, Aave’s withdrawal mechanism effectively halts. Suppliers wishing to exit cannot do so because the protocol only fulfills redemptions from idle liquidity in the pool. With borrowers holding nearly everything, no liquidity is left to pull. Stablecoin pools also felt pressure. While USDC and USDT reserves had no direct rsETH exposure, the broader exit pushed utilization in some stablecoin markets to high levels on certain deployments, with users reporting failed and delayed withdrawals.
DefiLlama data shows Aave’s total value locked (TVL) dropped from approximately $26.4 billion to $19.776 billion, a 24.11% decline on April 19 alone. The AAVE token fell 17.7% on the same day, reflecting market uncertainty over the bad debt and the potential impact on staked positions from the Umbrella mechanism activation.
Umbrella Backstop and Next Steps
Aave’s Umbrella system is the protocol’s built-in backstop for precisely such events. If bad debt is confirmed, the mechanism can draw on reserves and may involve slashing staked AAVE to cover the deficit. The exact impact on depositors is still being determined. Other protocols with overlapping liquidity, including Sparklend, reported rate spikes and temporary pauses as capital shifted away from affected markets.
As of April 19, no new exploits or expansions of the incident have been reported. ETH pool utilization remains elevated, and full withdrawal access depends on either panic subsiding organically or the Umbrella mechanism settling the bad debt and restoring confidence. The protocol’s next steps likely center on completing a bad debt review, issuing a formal Umbrella resolution, and monitoring whether outflows stabilize as the market absorbs the full picture of the KelpDAO incident.