Kelp DAO Bridge Exploit Drains $291M, Sparks $6.2B Aave Withdrawal Rush
Security & Exploits ·
A bridge exploit tied to Kelp DAO's rsETH token has led to a $291M theft and set off a $6.2B wave of withdrawals from Aave as users rush to pull funds tied to the affected asset.
The attacker reportedly extracted $291M in rsETH through a flaw in Kelp DAO's bridge infrastructure, according to decrypt.co, which also reported the resulting liquidity crunch drove roughly $6.2B in withdrawal activity on Aave. Because rsETH is used as collateral within Aave's markets, the exploit raised concerns about whether the token's backing still matched its supply, prompting depositors to move funds out ahead of any broader disruption.
In response, Aave and Compound announced a joint technical remediation plan aimed at addressing the fallout from what is described elsewhere in the cluster as a $290M Kelp DAO hack, with the stated goal of restoring rsETH's collateral backing across affected markets.
Aave has since laid out a multi-stage recovery plan following the loss of 116,500 rsETH in the exploit, targeting the recovery of 29,776 ETH spread across Ethereum and Arbitrum. The staged approach suggests the process of reconciling collateral will unfold over multiple steps rather than a single fix, though the specifics of each stage and its timeline have not been detailed in the material available.
Separately, Kelp DAO has shifted blame for the incident on