Key Takeaways

• Aave’s total value supplied dropped by $15 billion—from $45.8B to $30.8B—following the Kelp DAO bridge hack.

• The exploiter used stolen rsETH to borrow other assets on Aave, creating a potential bad debt hole of up to $230 million.

• While Aave saw outflows, competitor SparkLend recorded a $1.3 billion surge in TVL, highlighting a shift toward more conservative collateral.

The decentralized finance (DeFi) ecosystem is facing one of its most severe stress tests of 2026. Aave, the industry’s largest lending protocol, has experienced a staggering $15 billion withdrawal in just a few days.

This flight of capital was triggered by a $293 million exploit of the Kelp DAO bridge, which allowed an attacker to mint uncollateralized rsETH. Because rsETH is integrated across the DeFi “stack,” the attacker was able to deposit the tainted tokens into Aave to borrow liquid assets, leaving the protocol with a significant imbalance that has spooked institutional and retail depositors alike.

Kelp exploit spreads through DeFi

The incident highlights the inherent risks of DeFi “composability.” When the Kelp DAO bridge was compromised via a LayerZero-powered verifier, the “bad debt” didn’t stay within Kelp; it flowed directly into Aave’s lending pools. According to research from Talos, the shortfall on Aave could range from $123 million to $230 million, depending on how the remaining losses are allocated.

This uncertainty led to a “liquidity crunch” where Aave’s v3 Wrapped Ether (WETH) market briefly hit 100% utilization, making it impossible for some users to withdraw immediately. While Aave has since unfrozen parts of its Ethereum V3 market, many reserves across Arbitrum, Base, and Mantle remain locked as the DAO scrambles to assess the total exposure.

Traders bet against socialized losses

The community is now embroiled in a debate over how to fill the hole. Aave’s risk managers have presented two main scenarios: socializing the losses across all rsETH holders (resulting in less bad debt for Aave) or shifting the burden entirely to Layer-2 networks (resulting in a higher $230 million debt).

On prediction markets like Polymarket, traders are actively betting on the outcome, with only 20% currently wagering that Kelp DAO will choose to socialize the losses across the mainnet. Meanwhile, the Aave Treasury, valued at $181 million, stands ready to cushion the blow, but the incident has already dented market confidence, with the AAVE token price dropping over 20% to the $90 support level.

Final Thoughts

The “Kelp Contagion” proves that yield-bearing restaked assets are a double-edged sword. Aave’s recovery will depend on its ability to handle this bad debt without sacrificing the trust of its remaining $30 billion depositor base.

Frequently Asked Questions

Is my money safe on Aave?
Most markets are functional, but rsETH-linked reserves remain frozen on several Layer-2 networks while risk is assessed.

What is “bad debt” in DeFi?
It occurs when the value of a borrower’s collateral falls below the value of their loan, and the protocol cannot liquidate it profitably.

Where did the withdrawn funds go?
A significant portion ($1.3B) migrated to SparkLend, which is perceived to have stricter collateral caps.