Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, with the outcome dependent on how the situation is resolved. The incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to transfer tokens between blockchains. An attacker exploited this setup by forging a valid-looking transfer message, resulting in the creation of new tokens without backing. The attacker then deposited these tokens into Aave as collateral and borrowed approximately $190 million in ETH and related assets. To mitigate the risk, Aave Labs swiftly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset. The outcome now largely depends on how Kelp handles the shortfall, with two possible scenarios: a 15% depegging of the token if losses are spread across all rsETH holders, resulting in around $124 million in bad debt for Aave, or a more severe impact if losses are isolated to Layer 2 networks, with bad debt rising to roughly $230 million. The exploit stemmed from weaknesses in Kelp's verification of cross-chain messages using LayerZero, allowing the attacker to extract value from the system. In response to the incident, users withdrew around $6 billion in total value locked from Aave, reflecting a broad pullback due to uncertainty. The episode highlights Aave's indirect exposure to external systems, with increased collateral risk, pressure on lending positions, and a decline in deposits. Discussions are underway with ecosystem participants to address potential losses, with Kelp's DAO treasury holding approximately $181 million in assets.