Aave Faces $6 Billion Deposit Withdrawal Following Kelp Hack, Exposing DeFi Lender's Structural Vulnerability

Aave witnessed a staggering $6.6 billion exodus, not due to a direct hack, but as a result of a security breach in the Kelp protocol. The total value locked in Aave dropped from $26.4 billion to nearly $20 billion, with the AAVE token price falling 16% to $92 and daily fees surging to $1.99 million amidst a flurry of liquidations. Depositors are fleeing due to Aave's involuntary exposure to a hole created by the Kelp hack, where attackers drained 116,500 rsETH and used them as collateral to borrow wrapped ether on Aave V3. On-chain data estimates the Aave-specific borrow at approximately $196 million, with total positions across Aave, Compound, and Euler reaching $236 million. As the largest lending protocol in DeFi, Aave allows users to deposit crypto to earn yield, while others borrow against collateral. However, the recent hack has highlighted the protocol's vulnerability to external exploits, particularly when accepting liquid restaking tokens as collateral. The concentration of Aave's loan book on Ethereum, with WETH being 39.49% of all loans, has exacerbated the damage. Founder Stani Kulechov confirmed that the exploit was external and Aave's contracts were not compromised, but the protocol's acceptance of a liquid restaking token as collateral has left depositors at risk. The incident has sparked concerns about the fragility of the DeFi system, with the AAVE token price now reflecting the uncertainty surrounding the Umbrella reserve's ability to cover the resulting bad debt.