Aave Faces $6 Billion Deposit Exodus Following Kelp Hack, Exposing DeFi Lender's Structural Vulnerabilities

Aave has witnessed a massive $6.6 billion exodus, not due to a direct hack, but as a result of a cascading effect from the Kelp bridge exploit. The protocol's total value locked plummeted from $26.4 billion to nearly $20 billion, with the AAVE token experiencing a 16% decline to $92 and daily fees surging to $1.99 million amidst widespread liquidations. Depositors are fleeing due to Aave's exposure to a vulnerability it did not create. Attackers drained 116,500 rsETH from Kelp's bridge and used the stolen tokens as collateral on Aave V3 to borrow wrapped ether. On-chain data indicates that the Aave-specific borrow amounts to approximately $196 million, with total positions across Aave, Compound, and Euler reaching $236 million. As the largest lending protocol in DeFi, Aave allows users to deposit crypto to earn yield, while others borrow against collateral. The exploited Kelp protocol, a liquid restaking platform, issued rsETH tokens that some users posted as collateral on Aave. The attack involved tricking Kelp's cross-chain bridge into releasing 116,500 rsETH, worth about $292 million, to an attacker-controlled address, which was then used to borrow wrapped ether on Aave V3. Initially, Aave stated that the Umbrella reserve would cover any deficit, but later softened its stance to exploring paths to offset the deficit. The concentration of Aave's loan book on Ethereum, with $14.24 billion of the $17.82 billion in outstanding borrows, and the dominance of WETH loans, explains why the damage is significant. Aave's founder, Stani Kulechov, confirmed that the exploit was external and the protocol's contracts were not compromised. However, the acceptance of liquid restaking tokens as collateral, which lost their backing due to the bridge exploit, has put depositors at risk. The whitelisting of liquid restaking tokens across major lending protocols, due to their yield and growing share of Ethereum's locked value, did not account for the scenario where the collateral's value drops to zero due to a bridge exploit. The current token price reflects the market's assessment of whether the Umbrella reserve is sufficient to cover the resulting hole and whether stkAAVE holders will bear the loss.