Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of suffering losses of up to $230 million, contingent upon the resolution of the situation. According to a report published by Aave Labs and LlamaRisk on the Aave governance forum, the incident revolves around rsETH, a liquid restaking token issued by KelpDAO, which relies on a bridge mechanism to transfer tokens between blockchains. The attacker manipulated this setup by creating a forged transfer message, resulting in the creation of new, unbacked tokens. Approximately 89,567 rsETH were deposited into Aave as collateral, with the attacker borrowing around $190 million in ETH and related assets across Ethereum and Arbitrum. Aave swiftly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The outcome now hinges on Kelp's handling of the shortfall, with potential losses ranging from $124 million to $230 million, depending on whether the losses are spread across all rsETH holders or isolated to Layer 2 networks. The exploit was made possible by weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to extract value from the system. In response to the incident, users have withdrawn around $6 billion in total value locked from Aave, reflecting a broader pullback due to uncertainty. The episode highlights Aave's indirect exposure to external systems, with increased collateral risk, pressure on lending positions, and a decline in deposits as users reassess the safety of interconnected DeFi infrastructure.