Aave Faces Potential $230 Million Loss Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million. The incident occurred when an attacker manipulated the bridge mechanism, creating unbacked tokens and depositing them into Aave as collateral to borrow approximately $190 million in ETH and related assets. Aave promptly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing to contain the risk. The outcome now hinges on how Kelp DAO handles the shortfall, with potential losses ranging from $124 million to $230 million. The exploit was made possible by weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to extract value from the system. In response, users withdrew around $6 billion in total value locked from Aave, highlighting concerns about the safety of interconnected DeFi infrastructure and the potential for undercollateralized loans.