Aave Resumes rsETH Operations: $293M Kelp DAO Exploit Recovery Underway

Aave, the world's largest DeFi lending protocol, has resumed rsETH operations alongside Kelp DAO following the April exploit that drained $293 million in restaked ETH and triggered a $6.6 billion TVL collapse. The coordinated recovery marks a watershed moment for DeFi resilience.

What Happened

On April 18, 2026, attackers exploited a single-verifier vulnerability in Kelp DAO's LayerZero bridge, fraudulently minting 116,500 rsETH worth approximately $293 million. The exploit — the largest DeFi hack of 2026 — did not compromise Aave's own contracts but left roughly $196 million in Aave-specific bad debt concentrated in the dominant Ethereum market. Panic withdrawals followed: Aave recorded $5.4 billion in ETH outflows and total deposits plunged $15 billion as users fled all markets, driving TVL down from over $20 billion to below $14 billion within days.

Why It Matters

The Kelp DAO exploit exposed a structural flaw in DeFi's interconnected architecture: a trusted bridge failure cascaded into the protocol that depended on it. Aave absorbed $196 million in bad debt — not from its own code failure, but from a dependency it trusted. The crisis forced Aave to freeze rsETH markets and sparked a governance debate over whether AAVE stakers in the Safety Module should underwrite the loss. With Aave's treasury at $83 million and ETH price appreciation worsening the bad debt hourly, the protocol's ability to recover without token dilution became a test case for DeFi's self-healing capacity.

What's Next

Kelp DAO and Aave have initiated a two-week refill plan, progressively returning 117,132 rsETH (approximately $278 million at current prices) to the LayerZero bridge. Aave has raised nearly 80% of the $200 million needed to cover bad debt through coordinated industry pledges exceeding $300 million. Meanwhile, Aave V4 development advances with cross-chain liquidity capabilities, Horizon institutional expansion, and a mobile app rollout slated for 2026. The SEC's closure of its four-year investigation clears regulatory headwinds. If the rsETH peg restoration holds, Aave will demonstrate that DeFi's largest lender can absorb a nine-figure external shock and emerge with stronger risk controls — a precedent the entire ecosystem is watching. Bitcoin Below $60K: 21-Month Low as ETF Outflows Hit $4.4B | Bitdeer Liquidates Entire Bitcoin Treasury: $205M Sale Funds AI Data Center Pivot | Ford Sues Lemon Law Firm: $100M Fraud Alleged in Legal Fee Inflation Scheme | Tether Gold XAUT: 3B Gold Reserves Now Power Bullion-Backed Loans via Ledn | Ether XRP Dogecoin Lead Crypto Selloff | MicroStrategy Stock Plunges 9% | Bitcoin Hits 21-Month Low: $1.3B ETF Outflows

August 2026 Update: Refill Complete, V4 Live — TVL Rebuilds to USD 14.3B

The recovery plan executed in full. Kelp DAO and Aave burned the exploiter's rsETH on Arbitrum on May 12-13 and progressively returned all 117,132 rsETH (about USD 278 million) to the LayerZero bridge over the following two weeks, per Cointelegraph and Bitcoin Foundation reporting. The DeFi United coalition — seven protocols including Lido and EtherFi — assembled USD 303 million in pledges plus a credit facility of up to 30,000 ETH to backstop the USD 196-230 million bad debt, the largest coordinated bailout in DeFi history.

The protocol has stabilized well below pre-hack levels but is rebuilding. Aave's TVL stands at USD 14.27 billion per DefiLlama, up from the sub-USD 14 billion panic trough, with V3 at USD 13.7 billion. Aave V4 — live on Ethereum mainnet since March 30 with its hub-and-spoke architecture — has grown to USD 198.78 million in TVL, up 43% in 30 days, after the DAO's May 4 activation vote.

AAVE trades near USD 92-96 as of July 31 (Coinbase, Kraken, CoinMarketCap), a market cap near USD 1.48 billion. Grayscale's June research note argues AAVE could more than double to USD 175 within a year if the protocol converts lending revenue and tokenized-asset flows into token value. The exploit's final lesson is now governance, not survival: who pays for bridge failures — stakers, bridged-asset holders, or the bridge itself — remains contested on Aave's governance forum.