$15B exodus from Aave triggered by Kelp DAO security breach
The decentralized lending platform Aave has experienced a massive decline in supplied balances following the Kelp DAO bridge security breach, with users withdrawing funds due to concerns about the protocol's exposure to rsETH-related losses.
The leading decentralized lending platform Aave has witnessed approximately $15 billion in withdrawals following the exploitation of Kelp Dao that occurred over the weekend.
Data from Aavescan indicates that the total value supplied to Aave dropped from $45.8 billion on Saturday to $30.8 billion by Wednesday.
This significant decrease came after a security breach that siphoned approximately 116,500 restaked Ether (rsETH), valued at around $293 million, from the LayerZero-powered rsETH bridge operated by Kelp DAO. Following the theft, the attacker utilized a portion of these stolen assets to take out loans on Aave.
According to Aave's incident report, 89,567 rsETH were deposited on the protocol and the resulting shortfall could range from approximately $123 million to $230 million, contingent upon the final allocation of losses.
According to Talos, an institutional digital asset trading platform, these withdrawals indicate concerns about potential contagion stemming from Aave's bad debt and a wider exodus of capital from the decentralized finance (DeFi) ecosystem.
In a Tuesday report, Talos noted that the bad debt generated by the Kelp exploiter caused Aave's v3 Wrapped Ether (WETH) market to temporarily hit 100% utilization, which left no liquidity available for instant withdrawals.
In a Wednesday post on X, blockchain analyst EmberCN noted that SparkLend's total value locked (TVL) increased by $1.3 billion following the Kelp DAO exploit, suggesting that the fourth-largest lending protocol was capturing some of the capital withdrawn from Aave.
Kelp exploit spreads through DeFi lending
The situation illustrates how the interconnected nature of DeFi is a double-edged sword, as the Kelp DAO exploit rippled through lending markets and developed into a "broader liquidity crunch," Tanay Ved, senior research associate at Talos, told Cointelegraph.
According to Ved, the asset combined risks across restaking, bridging and lending layers, enabling the impact to propagate well beyond the original exploit, and she emphasized that the incident underscores the necessity for a more resilient collateral framework and a more comprehensive security approach to tackle the systemic vulnerabilities of yield-bearing assets.
On Tuesday, Aave announced it had unfrozen WETH reserves on the Ethereum Core V3 market, allowing users to supply WETH to the V3 lending protocol, however WETH reserves across Ethereum Prime, Arbitrum, Base, Mantle and Linea remain frozen.
Traders bet Kelp DAO won't socialize losses
Aave's risk manager presented two potential scenarios for handling the bad debt on Monday. The first scenario entails distributing the losses across all rsETH token holders on Ethereum mainnet and layer-2s, which would leave approximately $123 million in bad debt on Aave.
The second option would transfer the shortfall entirely to layer-2 networks, which would result in approximately $230 million in bad debt on Aave.
According to Polymarket data, traders flocked to prediction markets to wager on the outcome, with 20% of traders betting on Kelp DAO socializing the losses across rsETH holders on mainnet, rather than L2 holders bearing the shortfall.