Aave Faces $6 Billion Deposit Exodus After Kelp Hack Exposes DeFi Lender's Structural Vulnerabilities

Aave has experienced a significant exodus of funds, with $6.6 billion in deposits withdrawn, not due to a direct hack on the platform, but rather a result of the Kelp hack, which has exposed a structural risk for the DeFi lender. The total value locked in Aave dropped from $26.4 billion to nearly $20 billion, with the AAVE token falling 16% to $92 and daily fees surging to $1.99 million amidst a wave of liquidations over the weekend. Depositors are fleeing Aave because the platform is now carrying a debt it did not create, stemming from the theft of 116,500 rsETH from Kelp's bridge, which was then used as collateral to borrow wrapped ether on Aave V3. On-chain trackers estimate the Aave-specific borrow to be around $196 million, with total positions across Aave, Compound, and Euler totaling $236 million. Aave, as the largest lending protocol in DeFi, allows users to deposit crypto to earn yield, while others borrow against collateral. The stolen rsETH, which is a receipt token issued by Kelp for ether that has already been staked on Ethereum, was used as collateral by some users on Aave, leaving the platform vulnerable to the hack. The attack on Kelp's cross-chain bridge resulted in the theft of approximately $292 million worth of rsETH, which was then deposited onto Aave V3 as collateral and used to borrow wrapped ether. Aave initially stated that the Umbrella reserve would cover any deficit, but later softened its stance to exploring paths to offset the deficit. The concentration of Aave's loan book on Ethereum, with $14.24 billion of the $17.82 billion in outstanding borrows, and the dominance of the WETH pair, with 39.49% of all loans on the protocol, have exacerbated the damage. Stani Kulechov, Aave's founder, confirmed that the exploit was external and the protocol's contracts were not compromised, but acknowledged that Aave accepted a liquid restaking token as collateral, which lost its backing due to the bridge exploit. The risk models used by Aave and other lending protocols had priced liquid restaking tokens as if they would hold their peg under normal conditions, but did not account for a scenario where the collateral would become worthless due to a bridge exploit. The incident has highlighted the fragility of the DeFi system, with trader Altcoin Sherpa noting that Aave's contagion risk has significant implications for the entire ecosystem. The current token price is reflecting the market's attempt to assess whether the Umbrella reserve is sufficient to cover the resulting hole and whether stkAAVE holders will bear the loss.