Aave Faces $6 Billion Deposit Exodus Following Kelp Hack, Exposing DeFi Lender's Structural Vulnerability

Aave has witnessed a staggering $6.6 billion departure, not due to a direct hack, but as a result of a breach in Kelp's bridge, which has left the protocol grappling with a significant shortfall. The total value locked in Aave dropped from $26.4 billion on April 18 to approximately $20 billion by Sunday morning, according to DefiLlama. The AAVE token price fell 16% to $92, while daily fees surged to $1.99 million amidst widespread liquidations over the weekend. Depositors are fleeing due to Aave's unforeseen exposure to a vulnerability it did not create. Attackers drained 116,500 rsETH from Kelp's bridge on Saturday and utilized the stolen tokens as collateral on Aave V3 to borrow wrapped ether. On-chain data estimates the Aave-specific borrow to be around $196 million, with total positions across Aave, Compound, and Euler totaling approximately $236 million. As the largest lending protocol in DeFi, where users deposit cryptocurrency to earn interest and others borrow against collateral, Aave's loan book is predominantly concentrated on Ethereum, with $14.24 billion of the $17.82 billion in outstanding borrows. The attack targeted the exact collateral-to-WETH pair that dominates Aave's book, resulting in significant damage. Aave's founder, Stani Kulechov, confirmed that the exploit was external and the protocol's contracts were not compromised. However, the acceptance of a liquid restaking token as collateral, which lost its backing due to a bridge exploit beyond Aave's control, has put depositors at risk. The incident highlights the fragility of the DeFi system, with trader Altcoin Sherpa noting that Aave's contagion risk has far-reaching implications for the entire ecosystem. The current token price reflects concerns over whether the Umbrella reserve is sufficient to cover the resulting shortfall and whether stkAAVE holders will bear the loss.