Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million. The incident involves rsETH, a liquid restaking token issued by KelpDAO, which was exploited by an attacker who forged a transfer message, resulting in the creation of unbacked tokens. The attacker then used these tokens as collateral to borrow approximately $190 million in ETH and related assets from Aave, leaving the platform exposed to potentially impaired collateral. Aave quickly took steps to mitigate the risk, freezing rsETH markets and halting new borrowing. The outcome depends on how Kelp DAO handles the shortfall, with possible losses ranging from $124 million if spread across all rsETH holders to $230 million if isolated to Layer 2 networks. The exploit highlights the risks associated with interconnected DeFi infrastructure and the importance of robust verification processes for cross-chain messages.