Alvin Lang
Apr 20, 2026 03:54
Aave loses $8 billion in TVL after hackers use stolen Kelp DAO funds as collateral, creating $195M in dangerous debt and freezing $5.1B in stablecoins.
Aave simply misplaced its crown as DeFi’s largest protocol. A $293 million exploit at Kelp DAO cascaded into an $8 billion TVL collapse at Aave over the weekend, with the AAVE token plunging 20% from $112 to $89.50 in roughly 25 hours.
The injury extends far past one protocol. Over $5.1 billion in USDT and USDC sits frozen in Aave v3 lending swimming pools, now at 100% utilization. Depositors cannot withdraw till new liquidity arrives or debtors repay.
How the Contagion Unfold
Saturday’s assault on Kelp DAO’s LayerZero bridge netted hackers 116,500 rsETH tokens. Reasonably than instantly dumping them, the attackers acquired inventive—they posted the stolen property as collateral on Aave v3 and borrowed wrapped Ether in opposition to them.
This created roughly $195 million in “dangerous debt” on Aave, in accordance with Lookonchain. The rsETH collateral, now tainted by the exploit, turned primarily nugatory for restoration functions.
What adopted was predictable: a financial institution run. DeFiLlama information exhibits Aave’s TVL cratered from $26.4 billion to $18.6 billion by Sunday. Main gamers fled first. MEXC pulled $431 million. Abraxas Capital yanked $392 million.
Stablecoin Swimming pools Seized Up
The USDT pool tells the story. Out of $2.87 billion deposited, precisely $2,540 was accessible for withdrawal at one level. That is not a typo—two thousand {dollars} liquid in an almost three-billion-dollar pool.
Aave responded by freezing rsETH markets on each v3 and v4 variations. WETH reserves acquired locked down throughout Ethereum, Arbitrum, Base, Mantle, and Linea. The protocol maintains that rsETH on Ethereum mainnet stays totally backed by underlying property, although that is chilly consolation for individuals who cannot entry their stablecoins.
DeFi’s Interconnection Drawback
The ripple results hold spreading. Curve Finance, Ethena, and BitGo’s WBTC have all paused LayerZero bridge integrations till the mess will get sorted.
This marks the primary actual stress take a look at of Aave’s “Umbrella” safety mannequin, launched in June 2025 to automate safety in opposition to dangerous debt. The timing could not be worse—Aave parted methods with threat supervisor Chaos Labs simply two weeks in the past over disagreements about v4 course and finances.
A Financial institution of Canada research earlier this month praised Aave v3 for avoiding dangerous debt via overcollateralization and automatic liquidations. That evaluation aged poorly.
What Occurs Subsequent
The quick query: when do stablecoin swimming pools unlock? That relies upon fully on whether or not new deposits arrive or current debtors repay. Neither appears imminent given present sentiment.
Aave v4 simply launched at EthCC with a brand new “hub-and-spoke” structure for real-world property. Whether or not that growth continues on schedule whereas the protocol manages this disaster stays unclear. For merchants, the AAVE token at $89.50 represents both a shopping for alternative or a falling knife—the following few days of TVL information will inform which.
Picture supply: Shutterstock
