Kelp DAO Incident: Cross-Chain Bridge Vulnerability and Aave's Losses
On April 18, 2026, the decentralized liquid restaking protocol Kelp DAO suffered a severe cross-chain bridge vulnerability attack. The attacker exploited a flawed implementation of the cross-chain bridge provided by LayerZero to mint approximately 116,500 unsupported rsETH tokens out of thin air, valued at about $292 million to $293 million at the time. The attack is suspected to be linked to the notorious North Korean hacking group Lazarus Group.
These fraudulently minted rsETH were subsequently deposited by the attacker as collateral into the Aave V3 and V4 lending protocols. The attacker used this to borrow a large amount of Ethereum (WETH/wstETH), resulting in approximately $177 million to $280 million in "bad debt" for the Aave protocol. This incident quickly sent shockwaves through the DeFi market. Aave's Total Value Locked (TVL) plummeted by approximately $8 billion to $10 billion from about $26.4 billion within days of the attack, briefly falling to the $17.5 billion to $18.6 billion range. The AAVE token price dropped nearly 20% within 25 hours of the attack, from $112 to $89.5.
Aave's Emergency Response and the DeFi United Alliance
In response to the crisis, Aave swiftly implemented emergency measures. The protocol immediately froze the affected rsETH and WETH markets, including those on Ethereum, Arbitrum, Base, Mantle, and Linea, and urgently adjusted the Loan-to-Value (LTV) ratio for rsETH to 0 to prevent new borrowing.
To address this large-scale loss and protect users, Aave service providers spearheaded the formation of an alliance called "DeFi United." This alliance brought together various DeFi protocols and individuals, including Lido, Ether.fi, Ethena, Compound, Mantle, ConsenSys, Joseph Lubin, Justin Sun/HTX, and Renzo, all committed to restoring rsETH's collateral backing and preventing the losses from being passed on to Aave users. Aave founder Stani Kulechov emphasized that Aave's core contracts were not compromised, the issue originated with Kelp DAO, and expressed confidence in the protocol's resilience.
Asset Replenishment and Full Liquidity Restoration
The DeFi United alliance's asset reimbursement efforts progressed rapidly. As of April 28, 2026, the alliance had successfully raised over $300 million (over 132,704 ETH), sufficient to cover the approximately $290 million loss. Subsequently, on May 6, 2026, Aave Labs liquidated the attacker's remaining rsETH positions on Ethereum and Arbitrum and transferred the collateral to the Recovery Guardian multisig wallet managed by DeFi United, a crucial step in the recovery plan.
By May 13, 2026, the funds raised by DeFi United had exceeded $318 million in ETH. Arbitrum DAO also approved the transfer of 30,765 frozen ETH (approximately $70 million) to the fund, although these funds were temporarily frozen by a court due to legal proceedings; Aave has filed an emergency motion to seek their release. Finally, on June 1, 2026, Aave announced that it had successfully restored full liquidity to its lending pools, replaced the depleted assets, protected depositors from losses, and resumed normal lending operations for the protocol.
Meanwhile, Kelp DAO also took proactive measures, abandoning the LayerZero cross-chain bridge and migrating to Chainlink CCIP, while comprehensively strengthening its security measures.
Industry Reflection: Trust Crisis and Resilience Demonstrated
The Kelp DAO incident and its impact on Aave undoubtedly triggered a profound trust crisis within the DeFi community, leading many industry insiders to re-examine the inherent trade-offs of decentralized technology. The sharp decline in Aave's TVL and the halt in lending activity initially indicated a severe blow to investor confidence.
However, the successful reimbursement efforts by the DeFi United alliance are seen as a powerful demonstration of the DeFi industry's unity and resilience. It could serve as a model for responding to future large-scale exploit incidents, helping to rebuild trust in liquid restaking products and cross-chain infrastructure. This incident also highlighted the DeFi ecosystem's reliance on "whales" and DAO treasuries, as well as the potential difficulties faced by small depositors during periods of capital outflow.
AAVE Token Trading Channels
AAVE, the native governance token of the Aave protocol, can be traded on multiple mainstream cryptocurrency exchanges. Users can find AAVE trading pairs on platforms such as CoinUp.io, KuCoin, Binance, FameEX, BitDelta, WhiteBIT, CoinW, Bybit, BTCC, Websea, Ourbit, Toobit, OKX, and Coinbase International Exchange. Please verify the specific terms of service and compliance of each platform before trading.
The platform information for sale in the article changes with the listing and delisting dynamics of each exchange. Please refer to the official announcements of the exchanges.
