Aave Faces $6 Billion Deposit Exodus Following Kelp Hack, Highlighting DeFi Risks

Aave has experienced a significant exodus of deposits, with $6.6 billion withdrawn, not due to a direct hack on the platform. The total value locked in the protocol dropped from $26.4 billion to nearly $20 billion, with the AAVE token falling 16% to $92 and daily fees surging to $1.99 million amidst widespread liquidations over the weekend. Depositors are fleeing because Aave is now carrying a liability it did not create, stemming from an attack on Kelp's bridge that resulted in the theft of 116,500 rsETH, which was then used as collateral on Aave V3 to borrow wrapped ether. On-chain data indicates the Aave-specific borrow amounts to roughly $196 million, with total positions across Aave, Compound, and Euler nearing $236 million. As the largest lending protocol in DeFi, Aave enables users to deposit crypto to earn yield, while others borrow against collateral. Kelp, a liquid restaking protocol, was exploited when attackers tricked its cross-chain bridge into releasing the stolen rsETH, worth about $292 million, which was then deposited onto Aave V3 as collateral to borrow wrapped ether. Aave initially stated that the Umbrella reserve would cover any deficit but later revised its stance to exploring paths to offset the deficit. The concentration of Aave's loan book on Ethereum, with $14.24 billion of the $17.82 billion in outstanding borrows, and the dominance of WETH, which accounts for 39.49% of all loans, explains why the damage is significant. Aave's founder, Stani Kulechov, emphasized that the exploit was external and did not compromise the protocol's contracts, but the acceptance of liquid restaking tokens as collateral has exposed Aave to risks it cannot control. The incident highlights the fragility of the DeFi system, with the AAVE token price reflecting concerns over whether the Umbrella reserve is sufficient to cover the potential losses and the implications for stkAAVE holders who back the reserve.