Aave Exploit: 93M Kelp DAO Hack Triggers DeFi Crisis

Largest 2026 exploit forces protocol overhaul and USD 71M court battle

2026-06-29 17:47:31 Updated 2026-08-13 16:15:02.214693 — min read 253 views

Aave Exploit: 93M Kelp DAO Hack Triggers DeFi Crisis

“Aave, the largest DeFi lending protocol, faces its biggest crisis yet after a $293 million Kelp DAO bridge exploit drained rsETH collateral, leaving $177-200 million in bad debt across Aave's wETH pool and triggering an $8.45 billion deposit run that stripped the protocol of its top DeFi ranking.

Aave, the world's largest decentralized lending protocol, is reeling from the fallout of the largest DeFi exploit of 2026. On April 18, attackers exploited a vulnerability in Kelp DAO's LayerZero-powered bridge to mint 116,500 unbacked rsETH tokens worth approximately $293 million. The stolen collateral was used to borrow wrapped ether from Aave's lending pools, leaving the protocol with an estimated $177-200 million in bad debt across its wETH market.

What Happened

On April 18, 2026, North Korea's Lazarus Group exploited a single-signer DVN (Decentralized Verifier Network) on Kelp DAO's LayerZero bridge, minting 116,500 unbacked rsETH tokens worth approximately $292 million. The attackers used the fraudulent rsETH as collateral on Aave to borrow $236 million in wrapped ether (wETH), leaving Aave with $177-200 million in bad debt across its wETH lending pool. Aave's total value locked plummeted from $26.4 billion to $17.9 billion — a 33% drop that cost the protocol its position as the largest DeFi platform. The AAVE token fell 16% as panic withdrawals accelerated. Aave immediately froze rsETH markets and initiated emergency governance procedures to contain the damage. Galaxy Research classified the attack as a "textbook" bridge exploit enabled by a single point of failure in LayerZero's verification layer.

Why It Matters

The Kelp DAO exploit revealed systemic risks in DeFi's reliance on cross-chain bridges and restaked assets. For the broader DeFi ecosystem managing $80+ billion in total value, the incident demonstrated how a single bridge vulnerability can cascade across protocols, triggering bank-run dynamics that threaten financial stability. The exploit forced Aave Labs to fundamentally rewrite its collateral and listing standards — expanding risk assessment beyond financial metrics to include cybersecurity and smart contract architecture reviews. The DeFi lending sector faces increased scrutiny, and regulators and institutional investors are scrutinizing DeFi's operational resilience more closely than ever. Aave's TVL fell sharply from above $26 billion, and total DeFi TVL slid from roughly $95 billion to $80 billion. (An earlier version of this article cited conflicting TVL figures — "$32 billion to $20.3 billion" — that did not match its own account; DefiLlama currently puts Aave's TVL near USD 14.3 billion, up about 17% over the past month as deposits recover.)

What's Next

August 2026 Update: Recovery Underway, But the USD 71 Million Fight Continues

The court fight moved — then got more complicated. A Manhattan federal judge modified the restraining notice and greenlit the Arbitrum DAO's vote to move the 30,765 recovered ETH (about USD 71 million) to Aave for victim repayment, per The Defiant. A subsequent US court order then barred the release after DPRK-sanctions victims pressed a competing claim dating to 2015, per Yahoo Finance — leaving the funds in limbo again.

rsETH operations have resumed. Kelp DAO and Aave completed key recovery steps in May, burning the exploiter's tokens and progressively refilling all 117,132 rsETH over two weeks, with withdrawals resuming within 24 hours of the first deposit. An Aave-led coalition, DeFi United, published the technical plan to restore rsETH backing and eliminate the bad debt.

V4 is rolling out in phases. Aave V4's Hub and Spoke architecture — unified liquidity at the Hub, specialized Spokes, starting with Prime (conservative collateral) and Core (standard lending) hubs — is designed to rebuild securities finance on-chain with the stricter collateral standards this exploit forced.

Deposits are recovering. DefiLlama currently puts Aave's TVL near USD 14.3 billion, up about 17% over the past 30 days — still far below the roughly USD 42 billion the protocol controlled in March, but the bank-run dynamic has reversed. The outcome of the frozen-ETH litigation and the effectiveness of the new collateral standards will set precedents for DeFi risk management in 2026 and beyond.

Related Reports

Frequently Asked Questions

On April 18, 2026, attackers exploited a LayerZero bridge vulnerability in Kelp DAO's rsETH protocol, draining approximately $293 million in what became the largest DeFi hack of the year. North Korea's Lazarus Group forged LayerZero lzReceive messages through a single-signer DVN to mint 116,500 unbacked rsETH tokens.

Attackers used fraudulent rsETH as collateral to borrow $236 million in wETH from Aave, creating $177-200 million in bad debt and triggering an $8.45 billion deposit run that dropped Aave's TVL by 33% from $26.4 billion to $17.9 billion. The AAVE token fell 16% as panic withdrawals accelerated.

Blockchain forensics and Galaxy Research attribute the attack to North Korea's Lazarus Group. The attackers exploited a single-signer DVN on Kelp DAO's LayerZero bridge to forge lzReceive messages and mint unbacked rsETH tokens across multiple chains.

The Arbitrum Security Council froze 30,765 ETH recovered from the exploit. A New York federal court has delayed Aave's emergency motion to unfreeze the funds, with a June hearing scheduled as creditors represented by Gerstein Harrow assert competing claims over the recovered assets.

Aave Labs is overhauling its collateral and listing standards to include cybersecurity and architecture reviews, expanding risk assessment beyond financial metrics. The protocol is also rolling out V4 infrastructure with enhanced securities finance capabilities and has published a comprehensive rsETH restoration plan to refill 117,132 rsETH over two phases.

Written by

SK Jabedul Haque

Founder & Chief Editor

Building India's most trusted finance education platform — simplifying news, schemes and market trends so anyone can understand and invest confidently.

Read full bio

Never miss an update

Get our clearest explainers on schemes, markets and money — read what matters, without the noise.

Explore more articles

In this article