Aave Faces Potential $230 Million Loss Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of losing up to $230 million, contingent upon the resolution of the situation. According to a report published by Aave Labs and LlamaRisk on the Aave governance forum, the incident revolves around rsETH, a liquid restaking token issued by KelpDAO. The protocol utilizes a bridge mechanism to transfer rsETH between blockchains, locking tokens on one chain while issuing corresponding tokens on another. An attacker exploited this setup by creating a forged transfer message that appeared legitimate, resulting in the creation of new tokens without backing. This led to the release of 116,500 rsETH from the Ethereum-side bridge, which the attacker then used as collateral to borrow approximately $190 million in ETH and related assets across Ethereum and Arbitrum. Aave has taken swift action to mitigate the risk, freezing rsETH markets and halting new borrowing against the asset. The outcome now largely depends on how Kelp DAO handles the shortfall. If the losses are spread across all rsETH holders, the token may experience an estimated 15% depegging, resulting in around $124 million in bad debt for Aave. However, if the losses are isolated to Layer 2 networks, the impact could be more severe, with bad debt potentially rising to approximately $230 million. The exploit was made possible by weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to manipulate the system and extract value. The incident has raised concerns about the security of interconnected DeFi infrastructure and the potential for undercollateralized loans. In response, users have withdrawn around $6 billion in total value locked from Aave, reflecting a broad pullback due to uncertainty. The report highlights Aave's indirect exposure to external systems, which has resulted in increased collateral risk, pressure on lending positions, and a decline in deposits. Discussions are currently underway with ecosystem participants to address potential losses, with Aave's DAO treasury holding approximately $181 million in assets.