Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losses of up to $230 million. The incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to move tokens between blockchains. An attacker exploited this setup by creating a fake transfer message, resulting in the creation of new, unbacked tokens. The attacker then used these tokens as collateral to borrow approximately $190 million in ETH and related assets from Aave, leaving the protocol exposed to potentially impaired collateral. Aave Labs has taken steps to mitigate the risk, including freezing rsETH markets and halting new borrowing. The outcome depends on how Kelp DAO allocates the shortfall, with possible losses ranging from $124 million if spread across all rsETH holders, to $230 million if isolated to Layer 2 networks. The exploit has raised concerns about the security of interconnected DeFi infrastructure and has led to a significant withdrawal of funds from Aave, with around $6 billion in total value locked being withdrawn following the incident.