Aave Faces $6 Billion Deposit Exodus Following Kelp Hack, Highlighting DeFi Risks

Aave has experienced a significant exodus of deposits, with $6.6 billion withdrawn, not due to a direct hack on the platform. The total value locked in the protocol dropped from $26.4 billion to nearly $20 billion, according to DefiLlama, with the AAVE token declining 16% to $92 and daily fees surging to $1.99 million amid liquidations over the weekend. Depositors are fleeing because Aave is shouldering a burden it did not create, stemming from the exploitation of Kelp's bridge, which resulted in the theft of 116,500 rsETH. The stolen tokens were then used as collateral on Aave V3 to borrow wrapped ether, with on-chain trackers estimating the Aave-specific borrow to be around $196 million. As the largest lending protocol in DeFi, Aave allows users to deposit crypto to earn yield, while others borrow against collateral. The hacked rsETH was used as collateral by some users, which has now become a significant issue for Aave. On Saturday, attackers tricked Kelp's cross-chain bridge into releasing the stolen rsETH, valued at approximately $292 million, and deposited it onto Aave V3 as collateral to borrow wrapped ether. Aave initially stated that the Umbrella reserve would cover any deficit but later softened its stance to exploring paths to offset the deficit. The concentration of loans on Ethereum, which holds $14.24 billion of the $17.82 billion in outstanding borrows, explains why the damage is significant. Aave's loan book spans 22 chains, but the attack targeted the exact collateral-to-WETH pair that dominates Aave's book, with WETH accounting for 39.49% of all loans on the protocol. Stani Kulechov, Aave's founder, emphasized that the exploit was external and the protocol's contracts were not compromised. However, Aave's acceptance of a liquid restaking token as collateral, which had its backing vanish due to a bridge exploit, has put depositors at risk. The incident highlights the risks associated with liquid restaking tokens, which were whitelisted across major lending protocols due to their yield and growing share of Ethereum's locked value. Risk models had priced these tokens as if they would hold their peg under normal conditions, but none accounted for a scenario where the collateral becomes worthless due to a bridge exploit on an unrelated chain. The token price is now reflecting the uncertainty surrounding whether the Umbrella reserve is sufficient to cover the resulting hole and whether stkAAVE holders who back the reserve will absorb the loss.