Aave Loses ₱477.95 billion ($8 billion) After ₱17.5 billion ($293 million) Kelp DAO Hack Freezes Pools
Aave's lending pools hit 100% utilization and froze withdrawals after hackers stole ₱17.5 billion ($293 million) from Kelp DAO and used it as collateral to borrow assets, triggering a liquidity crisis that wiped $8 billion from the protocol's total value locked.
Key Takeaway
Aave's $56 million backstop can't cover $177 million in bad debt, exposing fatal gap in its security model.
Hackers stole 116,500 rsETH tokens from Kelp DAO's LayerZero bridge on Saturday and deposited them as collateral on Aave v3 to borrow wrapped Ether. The move triggered a liquidity crisis that wiped $8 billion from Aave's total value locked by Sunday, with TVL falling from $26.4 billion to $18.6 billion as users rushed to withdraw funds.
MEXC pulled $431 million and Abraxas Capital withdrew $392 million, according to Lookonchain. The rush created about $195 million in bad debt on the protocol. Aave v3 USDT and USDC lending pools hit 100% utilization, locking $5.1 billion in stablecoins. Only $2,540 remained available for withdrawal from the $2.87 billion USDT pool at time of writing. AAVE token dropped 19.8% from $112 on Saturday at 6:00 pm UTC to $89.5 roughly 25 hours later.
Aave froze rsETH markets on v3 and v4, plus wETH reserves on Ethereum, Arbitrum, Base, Mantle and Linea. The protocol said rsETH on Ethereum mainnet remains fully backed by underlying assets. Curve Finance, Ethena and BitGo paused bridge use after the exploit.
Aave's Umbrella security model, introduced in June 2025, held only about $56 million in coverage on Ethereum against the estimated $177 million to $200 million in bad debt. That leaves a shortfall of roughly $120 million after backstop payout. Arbitrum has no backstop coverage at all. The protocol defended its liquidation-based model as a core safety mechanism that protects lenders while limiting downside for borrowers. Bank of Canada research found Aave avoided bad debt in its v3 market using overcollateralization and automated liquidations that shifted risk to borrowers. Aave parted ways with risk service provider Chaos Labs on April 6, 2026.
This article was written based on reporting from Cointelegraph.
