Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of significant losses, potentially up to $230 million. The incident involves rsETH, a liquid restaking token issued by KelpDAO, which is used to move tokens between blockchains through a bridge mechanism. An attacker manipulated this system by creating a fake transfer message, resulting in the creation of new tokens without backing, and subsequently deposited these tokens into Aave as collateral to borrow approximately $190 million in ETH and related assets. Aave has taken steps to mitigate the risk, including freezing rsETH markets and halting new borrowing. The final impact depends on how Kelp DAO handles the shortfall, with possible outcomes including a 15% depegging of the token, resulting in around $124 million in bad debt for Aave, or a more severe impact of up to $230 million in bad debt if losses are isolated to Layer 2 networks. The exploit highlights the risks associated with cross-chain messaging and the importance of robust validation mechanisms.