Kelp DAO's $293M Breach Triggers $8B Exodus from Aave Protocol
Following massive user withdrawals from the lending protocol, Aave's native token plummeted approximately 20% to reach $89.5 within a 24-hour period.
The decentralized lending protocol Aave experienced a dramatic decline in total value locked throughout the weekend, shedding close to $8 billion following an exploit of Kelp DAO worth $293 million. The attackers utilized Aave to borrow funds, resulting in approximately $195 million in uncollectible debt on the platform and sparking mass withdrawals from concerned users.
According to data collected by DeFiLlama, the total value locked in Aave plummeted from approximately $26.4 billion down to $18.6 billion by Sunday, causing the protocol to surrender its position as the leading DeFi protocol by TVL.
The lending pools on Aave v3 for USDt (USDT) and USDC (USDC) have now reached 100% utilization levels, which means over $5.1 billion in stablecoin assets remain locked and unavailable for withdrawal until either fresh liquidity enters the pools or existing borrows get repaid.
The dramatic decline in Aave's total value locked demonstrates how swiftly risk originating from an isolated security breach can propagate across the interconnected DeFi lending ecosystem, with the potential to trigger a major liquidity crisis.
Saturday marked the beginning of the incident when malicious actors successfully extracted 116,500 Kelp DAO Restaked ETH (rsETH) tokens valued at approximately $293 million from Kelp DAO's LayerZero-enabled bridge, subsequently deploying them as collateral on Aave v3 to secure loans in wrapped Ether (wETH).
According to cryptocurrency analytics firm Lookonchain, this exploitation generated approximately $195 million worth of "bad debt" within Aave, which played a significant role in the Aave (AAVE) token's steep decline of nearly 20%, dropping from $112 on Saturday at 6:00 pm UTC down to $89.5 roughly 25 hours following the initial incident.
Among the largest cryptocurrency whales withdrawing capital from Aave, Lookonchain identified MEXC crypto exchange and Abraxas Capital as leading the exodus with withdrawals totaling $431 million and $392 million, respectively.
Multiple cryptocurrency networks and protocols with connections to rsETH or the LayerZero bridge infrastructure have implemented temporary suspensions of bridge operations pending resolution of the security issue, including DeFi platform Curve Finance, stablecoin issuer Ethena and BitGo's Wrapped Bitcoin (WBTC).
Aave has frozen several rsETH, wETH markets
In the immediate aftermath of the Kelp DAO security breach, Aave announced it had frozen rsETH markets across both Aave v3 and v4 platforms as a preventative measure against any questionable borrowing activity, subsequently confirming that rsETH deployed on Ethereum mainnet continues to maintain full backing through underlying assets.
According to Aave's statements, WETH reserves have also been frozen across Ethereum, Arbitrum, Base, Mantle and Linea networks.
This security breach represents the inaugural major stress test for Aave's "Umbrella" security framework, which was launched in June 2025 with the objective of delivering automated safeguards against protocol bad debt while simultaneously allowing users to generate rewards.
Earlier in the month, research conducted by the Bank of Canada determined that Aave successfully prevented bad debt accumulation in its v3 market through implementation of overcollateralization requirements, automated liquidation mechanisms and additional strategies that transferred risk exposure to borrowers.
In statements provided to Cointelegraph, Aave representatives defended the protocol's liquidation-based approach, characterizing it as an essential safety feature designed to safeguard lenders while minimizing potential losses for borrowers.
This development arrives as Aave ended its relationship with Chaos Labs, its most long-standing DeFi risk service provider, on April 6, after conflicts emerged regarding the strategic direction of Aave v4 and budgetary limitations.