Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit on the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, with the final impact dependent on Kelp DAO's allocation of the shortfall. The incident involved an attacker manipulating the bridge mechanism to create new tokens without backing, resulting in 116,500 rsETH being released from the Ethereum-side bridge. The attacker then deposited 89,567 rsETH into Aave as collateral and borrowed approximately $190 million in ETH and related assets. Aave has taken steps to contain the risk, including freezing rsETH markets and halting new borrowing. The outcome now depends on how Kelp DAO handles the shortfall, with possible losses ranging from $124 million to $230 million. The exploit highlighted weaknesses in Kelp's verification process and exposed flawed assumptions in its validation of cross-chain data. In response, users have withdrawn around $6 billion in total value locked from Aave, reflecting a broad pullback as participants react to the uncertainty.