Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of losing up to $230 million, contingent upon the resolution of the situation. According to a report by Aave Labs and LlamaRisk, the incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to transfer tokens between blockchains. An attacker manipulated this setup by creating a forged transfer message, resulting in the creation of new tokens without backing, and releasing 116,500 rsETH from the Ethereum-side bridge. The attacker then deposited 89,567 rsETH into Aave as collateral and borrowed approximately $190 million in ETH and related assets. Aave Labs promptly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset to mitigate the risk. The outcome now hinges on Kelp's handling of the shortfall, with estimated losses ranging from $124 million if spread across all rsETH holders to $230 million if confined to Layer 2 networks. The exploit was made possible by weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to manipulate the system and extract value. The incident has raised concerns about mispriced or undercollateralized loans and has led to a significant withdrawal of total value locked from Aave, with around $6 billion being pulled out. The episode highlights Aave's indirect exposure to external systems and the need for ecosystem participants to address potential losses.