Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put Aave, a lending protocol, at risk of losing up to $230 million, depending on the outcome. The incident involved the manipulation of rsETH, a liquid restaking token, which was used to create unbacked tokens. An attacker forged a transfer message, resulting in the creation of 116,500 rsETH, which were then used as collateral to borrow approximately $190 million in ETH and related assets from Aave. To mitigate the risk, Aave quickly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset. The outcome now depends on how Kelp DAO allocates the shortfall, with two possible scenarios: a 15% depegging of rsETH, resulting in $124 million in bad debt for Aave, or a more severe impact of $230 million in bad debt if losses are isolated to Layer 2 networks. The exploit highlighted weaknesses in Kelp's verification of cross-chain messages using LayerZero, allowing the attacker to extract value from the system. In response, users withdrew around $6 billion in total value locked from Aave, reflecting a broad pullback due to uncertainty. The incident has raised concerns about the risks associated with interconnected DeFi infrastructure and the potential for undercollateralized loans.