Kelp DAO Exploit Triggers $293 Million Loss and Aave Token Price Drop

This exploit underscores vulnerabilities in decentralized finance (DeFi) systems, affecting liquidity and investor confidence.

• On April 18, 2026, Kelp DAO's rsETH bridge was exploited, draining approximately $293 million in unbacked tokens.
• Aave's token price dropped nearly 20%, from around $112 to $90, as panic withdrawals surged, leading to a liquidity crisis.
• Investigations are ongoing, with Aave freezing rsETH markets and derivatives markets showing signs of potential recovery.

• Kelp DAO operated a liquid restaking protocol that issued rsETH, which was widely used as collateral in DeFi platforms like Aave.
• The exploit was facilitated by a misconfigured decentralized verifier network (DVN) within LayerZero's cross-chain bridge, allowing unauthorized minting of tokens.
• The incident exposed systemic risks in DeFi, particularly as liquid restaking gained traction, with 18% of the circulating supply of rsETH affected.

On April 18, 2026, at approximately 17:35 UTC, an attacker exploited Kelp DAO's rsETH bridge, minting and draining 116,500 unbacked rsETH tokens valued at $293 million. This exploit allowed the attacker to deposit these tokens as collateral on Aave's V3 and V4 protocols, enabling the borrowing of legitimate Wrapped Ether (WETH) and creating nearly $200 million in bad debt, primarily in the rsETH/WETH trading pair.

As news of the exploit spread, panic ensued among major investors, or "whales," leading to significant withdrawals. Notably, MEXC withdrew $431 million, and Abraxas Capital followed with $392 million, pushing Aave's ETH pool utilization to 100% and interest rates skyrocketing to 14-15%. Within 48 hours, Aave's total value locked (TVL) plummeted from $26.4 billion to $17.5 billion, reflecting a broader liquidity crisis across the DeFi landscape, which saw a total decline of $13 billion in TVL.

In response, Aave's governance activated emergency measures, freezing rsETH markets across its deployments. The AAVE token price fell sharply, stabilizing near $90 after a drop of 16-20%. Meanwhile, derivatives markets indicated a rising open interest of 17%, reaching $316.5 million, alongside negative funding rates, suggesting a potential short squeeze and a possible rebound in the token's value.

LayerZero, the technology behind Kelp DAO's bridge, attributed the exploit to the misconfiguration of the DVN and linked the attack to North Korea's Lazarus Group, raising concerns about the security of cross-chain bridges. Justin Sun, a prominent figure in the crypto space, publicly offered to negotiate with the attacker, highlighting the ongoing complexities of managing security and trust in DeFi.

• DeFi investors holding AAVE or rsETH tokens may experience unrealized losses and withdrawal delays.
• Liquidity providers on Aave face increased borrowing costs and potential losses due to the liquidity crisis.
• Developers and protocols relying on LayerZero's technology may need to reassess their security measures and risk management strategies.

• Investigations into the exploit: Understanding the full scope of the attack and its implications for security protocols will be crucial for restoring confidence in DeFi.
• Market recovery indicators: Watch for signs of stabilization in AAVE's price and TVL across DeFi platforms, which could signal a rebound.
• Regulatory responses: Increased scrutiny on liquid restaking and cross-chain bridges may lead to new regulations that could reshape the DeFi landscape.