After the Kelp DAO exploit, the attacker used $292 million in stolen rsETH as collateral on Aave V3, generating roughly $196 million in bad debt and triggering a $6.6 billion TVL collapse.
Posted April 20, 2026 at 6:29 am EST.
The fallout from the $292 million Kelp DAO exploit landed hardest at Aave, DeFi’s largest lending protocol. After draining Kelp’s bridge on April 18, the attacker deposited the 116,500 stolen rsETH into Aave V3 as collateral and borrowed substantial amounts of wrapped ETH against it, saddling the protocol with an estimated $196 million in bad debt.
Amid contagion fears, Aave’s total value locked collapsed from $26.4 billion on April 18 to nearly $20 billion by Sunday morning, a decline of roughly $6.6 billion, per DefiLlama. Aave’s loan book holds $17.82 billion in outstanding borrows, with Ethereum alone accounting for $14.24 billion. Wrapped ETH represents 39.49% of all loans on the protocol, meaning the attack hit the exact collateral-to-borrowing pair that dominates Aave’s book.
This story is an excerpt from the Unchained Daily newsletter.
Subscribe here to get these updates in your email for free
Aave responded by freezing rsETH markets on both V3 and V4 to prevent additional collateral deposits. Founder Stani Kulechov confirmed Aave’s smart contracts were not compromised and said both versions “do not have further exposure to rsETH.” But Aave’s response to the bad debt question shifted during the episode: an initial statement suggesting the Umbrella safety module could cover the deficit was revised hours later to say the protocol would “explore paths to offset the deficit,” sparking fears that the reserve may fall short and that stkAAVE stakers could be called on to absorb residual losses. Aave’s native token fell 16% on the news.
The episode extended far beyond Aave. SparkLend and Fluid froze rsETH-related activity. Lido Finance paused deposits into its earnETH product because of rsETH exposure. Ethena temporarily shut down its own LayerZero OFT bridges from Ethereum mainnet as a precaution despite having no direct rsETH exposure. The total value locked across the DeFi sector fell 7% in 24 hours to $86 billion, according to The Block. The weekend made plain how deeply liquid restaking tokens are embedded in DeFi lending infrastructure, and how quickly a single compromised collateral asset can generate systemic pressure.
