KelpDAO rsETH Exploit Triggers $15.1B Outflow From Aave

On April 18 a vulnerability in KelpDAO’s LayerZero V2 implementation for rsETH allowed the creation of roughly 116,500 uncollateralized rsETH tokens, equal to about $293 million at the time.

On-chain activity shows the attacker used some proceeds to buy large amounts of Bitcoin, with BTC rising above $78,000 after those purchases. Tron founder Justin Sun publicly urged the attacker to return the funds, writing, “You can’t spend $300 million anyway.”

Aave recorded $15.1 billion in withdrawals over three and a half days following the incident. Total deposits on Aave fell from $48.5 billion before April 18 to $30.7 billion afterward, a decline of about one-third. On-chain flows show large withdrawals of stablecoins and ether as utilization rates rose across multiple lending markets.

Morpho, a competing lending layer, saw deposits drop from $11.7 billion to $10.2 billion over the same period.

SparkLend, a lending product within the MakerDAO ecosystem, received significant inflows. Its total value locked rose from $1.9 billion to $3.2 billion, an increase that reflects roughly $1.3 billion moved into the protocol. Market participants pointed to SparkLend’s supply caps and price feeds from multiple oracles as factors in the shift of funds.

Aave and risk model provider LlamaRisk published a joint report on April 20 estimating potential shortfalls from the rsETH incident between $123.7 million and $230.1 million. The report noted Aave’s treasury held about $181 million as a buffer and that the DAO had obtained indicative commitments from ecosystem partners to help cover any remaining shortfall. The analysis also highlighted Aave’s reliance on liquid staking derivatives that are issued and routed through third-party protocols.

The AAVE token fell more than 20% in the days after the exploit, dropping from roughly $115 to lows around $90 to $92. On-chain records show more than $6 million in token sales by large holders. By April 22 AAVE traded near $94, with short-term support around $90 and resistance near $96.

The incident produced rapid liquidity outflows and led users to reallocate assets to protocols perceived as having stronger immediate risk controls.