Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, depending on the resolution of the situation. The incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to move tokens between blockchains. An attacker manipulated this setup by creating a forged transfer message, resulting in the creation of new tokens without backing. The attacker then deposited these tokens into Aave as collateral and borrowed approximately $190 million in ETH and related assets. Aave Labs quickly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The outcome now depends on how Kelp DAO handles the shortfall, with potential losses ranging from $124 million to $230 million. The exploit was made possible by weaknesses in Kelp's verification of cross-chain messages using LayerZero, allowing the attacker to extract value from the system. This incident has raised concerns about the risk of undercollateralized loans and has led to a significant withdrawal of total value locked from Aave, with users reassessing the safety of interconnected DeFi infrastructure.