Key Takeaways:
Attackers obtained 116,500 rsETH from Kelp’s bridge on April 18, 2026, and deposited the tokens on Aave V3 as collateral to borrow wrapped ether (WETH). Aave’s WETH pool hit 100% utilization as $5.4B+ in outflows pushed TVL down 24.11%, with AAVE token falling 17.7% on April 19. Aave’s Umbrella backstop is predicted to cowl an estimated $177M–$200M in dangerous debt, with the challenge confirming the protocol’s contracts weren’t exploited.
Aave WETH Pool Hits 100% Utilization After rsETH Exploit Leaves $200M in Unhealthy Debt
As soon as KelpDAO paused rsETH contracts in response to the exploit, the collateral backing these borrow positions turned nugatory. The loans may now not be liquidated in any significant manner, leaving Aave holding dangerous debt throughout its WETH reserves. Estimates place complete borrowed worth throughout Aave and smaller exposures on Compound and Euler at as much as $200 million or extra.
Aave confirmed the protocol’s personal contracts weren’t exploited. “Aave’s contracts haven’t been exploited,” the challenge’s X account acknowledged, describing the occasion as a problem tied to rsETH. The crew froze rsETH markets on Aave V3 and V4, eliminated borrowing energy in opposition to that collateral, and set loan-to-value ratios to zero in affected deployments.
Aave founder Stani Kulechov acknowledged:
“rsETH has been frozen on Aave V3 and V4, the asset doesn’t have any borrowing energy as a measure on account of KelpDAO bridge exploit that occurred exterior of Aave. Each Aave V3 and V4 doesn’t have additional publicity to rsETH.”
The freeze stopped new exercise in opposition to rsETH, nevertheless it didn’t cease customers from attempting to exit the protocol fully. The worry of dangerous debt spillover set off a wave of withdrawals that hit Aave’s ETH and WETH swimming pools with pressure.
Outflows in ETH and WETH reportedly reached $5.4 billion inside hours. As capital drained out, a number of experiences mentioned pool utilization within the WETH market climbed to 100%. At that degree, no liquidity stays within the pool for suppliers to redeem in opposition to.
When a pool runs at full utilization on Aave, withdrawals cease working. Suppliers who need to exit can not, as a result of the protocol can solely fulfill redemptions from liquidity that’s sitting idle within the pool. With debtors holding practically every part, there may be nothing left to drag.
Stablecoin swimming pools felt strain from the identical dynamic. Whereas USDC and USDT reserves had no direct publicity to rsETH, the broader exit pushed utilization in some stablecoin markets to excessive ranges on sure deployments. Customers reported failed and delayed withdrawals throughout these markets as out there liquidity thinned out.
Aave’s complete worth locked (TVL) dropped from roughly $26.4 billion to $19.776 billion. Defillama knowledge exhibits a 24.11% TVL decline as of April 19. The AAVE token fell 17.7% on the identical day, in accordance with market knowledge, as holders priced in dangerous debt uncertainty and the mechanics of what an Umbrella activation would possibly imply for staked positions.
Aave’s Umbrella system is the protocol’s built-in backstop for precisely this sort of occasion. If dangerous debt is confirmed, the mechanism can draw on reserves and, relying on the scenario, could contain slashing staked AAVE to cowl the deficit. The exact affect on depositors continues to be being decided.
Different protocols linked to overlapping liquidity swimming pools, together with Sparklend, as reported price spikes and non permanent pauses as capital shifted away from affected markets.
As of April 19, no new exploits or expansions of the incident have been reported. ETH pool utilization stays elevated, and full withdrawal entry depends upon both panic subsiding organically or the Umbrella mechanism settling the dangerous debt and restoring confidence within the reserves.
The protocol’s subsequent steps probably heart on finishing a nasty debt evaluate, issuing a proper Umbrella decision, and monitoring whether or not outflows stabilize as markets take in the total image of what the KelpDAO incident left behind.
