Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put Aave, a lending protocol, at risk of significant financial losses, potentially reaching $230 million. This incident centers around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to move tokens between blockchains. An attacker manipulated this setup by forging a valid transfer message, resulting in the creation of new, unbacked tokens. The attacker then used these tokens as collateral on Aave, borrowing approximately $190 million in ETH and related assets. Aave quickly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The outcome now largely depends on how Kelp handles the shortfall. If losses are spread across all rsETH holders, Aave may face around $124 million in bad debt, but if losses are isolated to Layer 2 networks, the impact could be more severe, with bad debt potentially reaching $230 million. This incident has raised concerns about the security of interconnected DeFi infrastructure and has led to a withdrawal of around $6 billion in total value locked from Aave. Discussions are underway to address potential losses, with Aave's DAO treasury holding approximately $181 million in assets.