Aave Faces $6 Billion Deposit Exodus Following Kelp Hack, Exposing DeFi Lender's Structural Vulnerability

Aave witnessed a staggering $6.6 billion withdrawal, not due to a direct hack, but as a result of a vulnerability exposed by the Kelp hack. The protocol's total value locked plummeted from $26.4 billion to nearly $20 billion, with the AAVE token falling 16% to $92 and daily fees surging to $1.99 million amidst a wave of liquidations over the weekend. Depositors are fleeing as Aave carries a burden it did not create, stemming from the exploitation of Kelp's bridge, which saw 116,500 rsETH tokens drained and subsequently used as collateral on Aave V3 to borrow wrapped ether. On-chain trackers estimate the Aave-specific borrow to be around $196 million, with total positions across Aave, Compound, and Euler nearing $236 million. As the largest lending protocol in DeFi, Aave enables users to deposit crypto to earn yield, while others borrow against collateral. The recent hack has highlighted the risks associated with accepting liquid restaking tokens as collateral, which can have their backing vanish due to exploits on external bridges. Aave's founder, Stani Kulechov, emphasized that the exploit was external and the protocol's contracts were not compromised. However, the concentration of loans on Ethereum and the dominance of the WETH pair in Aave's loan book have exacerbated the damage. The incident has sparked concerns about the fragility of the DeFi system, with the AAVE token price now reflecting the market's assessment of whether the Umbrella reserve is sufficient to cover the resulting hole and whether stkAAVE holders will bear the loss.