Aave Loses $6 Billion in Deposits as Kelp Hack Triggers Structural Reckoning

Aave — the largest decentralized lending protocol by total value locked — has recorded one of the most severe single-day deposit withdrawals in its history following the $292 million Kelp DAO exploit on Saturday. More than $6 billion left the protocol within hours of the attack becoming public, as depositors rushed to withdraw funds in anticipation of bad debt accumulation and potential protocol insolvency risk. The AAVE governance token fell 16% on the day, erasing weeks of gains.

The Mechanism of Contagion

The damage to Aave was not incidental — it was structural. The Kelp DAO attacker, having minted unbacked rsETH through the cross-chain exploit, deposited the drained tokens directly into Aave as collateral and used them to borrow real wETH from the protocol's liquidity pools. Because Aave's oracle infrastructure recognized rsETH at its pre-exploit market price, the protocol extended credit against collateral that was rapidly depegging and losing value.

By the time the Aave risk team identified and froze rsETH markets, a significant volume of wETH had already been borrowed against collateral now worth a fraction of its nominal value. The protocol is currently working to quantify the resulting bad debt — liabilities that the protocol absorbed because it extended loans against collateral it could not liquidate at face value.

Emergency Governance Response

Aave's risk committee triggered emergency governance powers to freeze all rsETH markets within hours of the exploit. The freeze prevents new borrowing and deposits in rsETH-linked pools while the protocol assesses its exposure. Aave's Safety Module — a reserve of staked AAVE tokens designed specifically to cover shortfalls — is being evaluated as a potential source of bad debt coverage, though the exact amount of losses remains unclear at time of publication.

Aave Labs founder Stani Kulechov acknowledged the severity of the situation in a public post, emphasizing that the core Aave protocol's solvency was not in question but that the incident exposed the risks of onboarding liquid restaking tokens with complex cross-chain dependencies as collateral.

Questions About LST and LRT Risk Management

The Kelp-Aave contagion has placed a spotlight on the due diligence frameworks DeFi lending protocols apply to liquid staking tokens (LSTs) and liquid restaking tokens (LRTs). Critics have long argued that accepting complex, multi-chain yield-bearing tokens as collateral introduces oracle and bridge risk that traditional over-collateralization ratios do not adequately price. The Kelp incident appears to have validated those concerns in the most costly way possible.

DeFi risk infrastructure providers including Chaos Labs and Gauntlet, both of which advise Aave on risk parameters, are expected to publish post-mortems detailing how rsETH's risk profile was assessed prior to the exploit and what changes to collateral onboarding criteria will be implemented going forward.