Aave Faces Potential Losses of up to $230 Million Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of losing up to $230 million. The incident revolves around rsETH, a liquid restaking token issued by KelpDAO. An attacker manipulated the bridge mechanism, creating new tokens without backing, and then used them as collateral to borrow approximately $190 million in ETH and related assets from Aave. To mitigate the risk, Aave quickly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset. The outcome now depends on how Kelp handles the shortfall, with potential losses ranging from $124 million to $230 million. The exploit stemmed from weaknesses in Kelp's verification process using LayerZero, allowing the attacker to extract value from the system. In response to the incident, users have withdrawn around $6 billion in total value locked from Aave, highlighting concerns over the safety of interconnected DeFi infrastructure.