Aave Faces Potential Losses of Up to $230 Million Due to Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, with the final impact hinging on the resolution of the situation. According to a report published by Aave Labs and LlamaRisk on the Aave governance forum, the incident centers on rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to transfer tokens between blockchains. An attacker exploited this setup by forging a valid-looking transfer message, resulting in the creation of new tokens without backing, and releasing 116,500 rsETH from the Ethereum-side bridge. Instead of selling the assets, the attacker used 89,567 rsETH as collateral to borrow approximately $190 million in ETH and related assets across Ethereum and Arbitrum, leaving Aave exposed to potentially impaired collateral. Aave Labs promptly contained the risk by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The outcome now largely depends on how Kelp handles the shortfall, with two possible scenarios: if losses are spread across all rsETH holders, Aave would face an estimated $124 million in bad debt, whereas if losses are isolated to Layer 2 networks, the impact would be more severe, with bad debt rising to roughly $230 million. The exploit stemmed from weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to manipulate the system and extract value. The incident has raised concerns about the safety of interconnected DeFi infrastructure, with around $6 billion in total value locked withdrawn from Aave following the incident. Discussions are underway to address potential losses, with Kelp's DAO treasury holding approximately $181 million in assets.