Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of significant losses, potentially reaching $230 million. The incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to transfer tokens between blockchains. An attacker exploited this setup by creating a forged transfer message, resulting in the creation of new tokens without backing. The attacker then deposited these tokens into Aave as collateral and borrowed approximately $190 million in ETH and related assets. To mitigate the risk, Aave Labs quickly froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset. The outcome now depends on how Kelp handles the shortfall, with potential losses ranging from $124 million if spread across all rsETH holders to $230 million if isolated to Layer 2 networks. The exploit has raised concerns about the security of interconnected DeFi infrastructure and has led to a significant withdrawal of total value locked from Aave.