Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit of the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of suffering losses of up to $230 million. According to a report by Aave Labs and LlamaRisk, the incident involved the manipulation of rsETH, a liquid restaking token issued by KelpDAO, which is used to move assets between blockchains via a bridge mechanism. An attacker forged a transfer message, resulting in the creation of new tokens without backing, and deposited a significant portion of these tokens into Aave as collateral to borrow approximately $190 million in ETH and related assets. Aave has since frozen rsETH markets, set loan-to-value ratios to zero, and halted new borrowing against the asset. The outcome depends on how Kelp DAO handles the shortfall, with possible losses ranging from $124 million if spread across all rsETH holders to $230 million if isolated to Layer 2 networks. The exploit highlighted weaknesses in Kelp's verification process using LayerZero and raised concerns about the risk of undercollateralized loans. In response, users have withdrawn around $6 billion in total value locked from Aave, and discussions are underway to address potential losses, with Kelp's DAO treasury holding approximately $181 million in assets.