Aave Faces $6 Billion Deposit Exodus After Kelp Hack Exposes DeFi Lender's Structural Vulnerability

Aave witnessed a massive $6.6 billion exodus, not due to a direct hack, but as a result of a security breach in Kelp's bridge, which allowed attackers to drain 116,500 rsETH and use it as collateral on Aave V3 to borrow wrapped ether. The total value locked in Aave dropped from $26.4 billion to nearly $20 billion, while the AAVE token price fell 16% to $92, and daily fees surged to $1.99 million amidst a wave of liquidations over the weekend. The crisis unfolded when attackers exploited Kelp's cross-chain bridge, releasing 116,500 rsETH, valued at approximately $292 million, to a controlled address. They then deposited the stolen tokens onto Aave V3 as collateral to borrow wrapped ether. Aave, the largest DeFi lending protocol, allows users to deposit cryptocurrency to earn yield, while others borrow against collateral. Kelp, a liquid restaking protocol, takes already-staked ether on Ethereum and channels it through EigenLayer, a separate yield-generating system, issuing an rsETH receipt token. Users trade and post rsETH as collateral on Aave to borrow against it. However, when attackers tricked Kelp's bridge into releasing the stolen rsETH, they deposited it onto Aave V3 as collateral and borrowed wrapped ether. Initially, Aave stated that the Umbrella reserve would cover any resulting deficit, but later softened its stance to exploring options to offset the shortfall. The concentration of Aave's loan book, with Ethereum holding $14.24 billion of the $17.82 billion in outstanding borrows, and WETH making up 39.49% of all loans, explains why the attack had a significant impact. Aave's founder, Stani Kulechov, emphasized that the exploit was external and did not compromise the protocol's contracts. However, Aave's acceptance of liquid restaking tokens as collateral, which lost their backing due to a bridge exploit on an unrelated chain, has put depositors at risk. The incident highlights the fragility of the DeFi system, with trader Altcoin Sherpa noting that Aave's contagion risk exposes the vulnerability of the entire system. The current token price reflects the market's attempt to gauge whether the Umbrella reserve is sufficient to cover the resulting hole and whether stkAAVE holders will absorb the loss.