Aave Faces $6 Billion Deposit Exodus After Kelp Hack Exposes DeFi Vulnerabilities

Aave has experienced a significant outflow of $6.6 billion in deposits, not due to a direct hack, but as a result of a security breach in the Kelp protocol. The total value locked in Aave dropped from $26.4 billion to nearly $20 billion, with the AAVE token falling 16% to $92 and daily fees surging to $1.99 million amidst a wave of liquidations over the weekend. Depositors are fleeing due to Aave's exposure to a vulnerability it did not create, stemming from the theft of 116,500 rsETH from Kelp's bridge, which was then used as collateral on Aave V3 to borrow wrapped ether. On-chain data indicates the Aave-specific borrow amounts to approximately $196 million, with total positions across Aave, Compound, and Euler reaching around $236 million. As the largest lending protocol in DeFi, Aave allows users to deposit cryptocurrency to earn yield, while others borrow against collateral. The stolen rsETH, valued at about $292 million, was used to borrow wrapped ether, putting Aave at risk of significant bad debt. The concentration of Aave's loan book, with Ethereum holding $14.24 billion of the $17.82 billion in outstanding borrows, and WETH comprising 39.49% of all loans, exacerbates the damage. Aave's founder, Stani Kulechov, confirmed the exploit was external and the protocol's contracts were not compromised, but acknowledged the risk of accepting liquid restaking tokens as collateral, which can have their backing vanish due to external factors. The incident highlights the fragility of the DeFi system, with the AAVE token price reflecting concerns over whether the Umbrella reserve is sufficient to cover the potential losses and the impact on stkAAVE holders who back the reserve.