Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of losing up to $230 million, depending on the outcome of the situation. The incident involved the manipulation of rsETH, a liquid restaking token issued by KelpDAO, which is used to move assets between blockchains. An attacker took advantage of a weakness in the bridge mechanism, creating new tokens without backing and releasing 116,500 rsETH from the Ethereum-side bridge. Instead of selling the assets, the attacker used 89,567 rsETH as collateral to borrow approximately $190 million in ETH and related assets from Aave, exposing the protocol to potentially impaired collateral. Aave Labs quickly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The extent of the losses now depends on how Kelp handles the shortfall, with two possible outcomes: a 15% depegging of rsETH, resulting in around $124 million in bad debt for Aave, or a more severe impact of roughly $230 million in bad debt if losses are isolated to Layer 2 networks. The exploit was made possible by weaknesses in Kelp's verification process for cross-chain messages using LayerZero, allowing the attacker to make certain assets appear fully backed when they were not. The incident has raised concerns about the potential for undercollateralized loans and has led to a significant withdrawal of around $6 billion in total value locked from Aave. The episode highlights the indirect exposure of Aave to external systems and the potential risks associated with interconnected DeFi infrastructure. Discussions are currently underway to address potential losses, with Aave's DAO treasury holding approximately $181 million in assets.