Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, depending on the outcome. The incident involved an attacker manipulating the bridge mechanism to create unauthorized tokens, resulting in 116,500 rsETH being released from the Ethereum-side bridge. The attacker then used these tokens as collateral to borrow approximately $190 million in ETH and related assets from Aave, exposing the protocol to potentially impaired collateral. Aave swiftly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The final impact depends on how Kelp DAO allocates the shortfall, with estimated losses ranging from $124 million if spread across all rsETH holders to $230 million if isolated to Layer 2 networks. The exploit highlighted weaknesses in Kelp's verification process using LayerZero, allowing the attacker to manipulate cross-chain messages and extract value from the system. As a result, users withdrew around $6 billion in total value locked from Aave, reflecting a broader pullback due to uncertainty. The incident has raised concerns about the safety of interconnected DeFi infrastructure and Aave's indirect exposure to external systems.