KelpDAO's rsETH bridge exploited for $292M, with $177M in bad debt now collateralized on Aave.
Security & Exploits ·
An exploit of KelpDAO's rsETH bridge drained approximately $292M in assets through a LayerZero cross-chain vulnerability, enabling an attacker to mint roughly 116,500 counterfeit rsETH tokens. The attacker then deposited this stolen rsETH as collateral on Aave V3 and V4, borrowed real WETH against it, and withdrew—leaving approximately $177M in unbacked bad debt sitting on Aave's platforms.
Aave's response was swift, freezing rsETH markets across V3 and V4 within hours, with Spark and Fluid following suit. The protocol clarified its own contracts remained uncompromised; the exploit targeted the bridge, not Aave itself. However, the fallout was severe: Aave's TVL dropped roughly 17% in 24 hours (from approximately $26B to approximately $21.5B), AAVE token fell approximately 18% in the same period and approximately 33% year-over-year, and ETH utilization hit 100% as users raced to withdraw.
The $177M in bad debt now poses a first live test for Aave's insurance mechanism, Umbrella, likely triggering slashing or forced recapitalization. rsETH's peg fractured, trading between $1,500 and $2,500 on Uniswap and down approximately 39% in 24 hours on one pair. Whether Aave's insurance absorbs the losses or requires asset sales remains uncertain.