Key Takeaways
- • A $291–$293 million exploit of Kelp DAO's rsETH cross-chain bridge on April 18, 2026, triggered a severe liquidity crisis across DeFi lending protocols, with Aave experiencing $5.4–$6.2 billion in ETH withdrawals within hours.
- • Aave's total value locked collapsed from $26.4 billion to approximately $20 billion over the weekend following the attack, representing a $6.4 billion outflow, while the AAVE governance token declined 12–18% as depositors panicked.
- • The attack exploited a LayerZero bridge vulnerability that allowed attackers to create unbacked rsETH tokens, deposit them as collateral on Aave, and borrow legitimate funds, creating "massive bad debt" rather than direct theft of user assets.
- • Contagion effects spread beyond Aave to other lending protocols including Morpho, Sky, and JupLend, with cross-chain withdrawal pressure evident on Solana and unaffected platforms, signaling systemic risk in DeFi infrastructure.
- • The incident exposed structural vulnerabilities in cross-chain bridging and composability risks inherent to decentralized finance, prompting widespread industry concern about the fragility of DeFi protocols and triggering broader asset flight from the sector.
Summary
On April 18, 2026, a single-function-call exploit drained approximately $291–$293 million from Kelp DAO's rsETH cross-chain bridge infrastructure, triggering one of decentralized finance's most significant liquidity crises. The attack targeted a bridge utilizing LayerZero technology that facilitates transfers of rsETH—Kelp DAO's liquid restaking token—across multiple blockchain networks. Rather than stealing existing rsETH, attackers exploited the bridge vulnerability to create unbacked rsETH tokens, which they then deposited as collateral on Aave, the largest DeFi lending protocol, to borrow legitimate funds. This mechanism created substantial bad debt within Aave's lending markets.
The immediate aftermath produced severe withdrawal pressure on Aave within hours of the exploit becoming public. Data indicates that ETH deposits experienced utilization rates spiking to 100%, meaning depositors who had provided Ethereum or wrapped Ethereum faced acute liquidity constraints and were unable to withdraw funds. The total value locked on Aave contracted sharply from $26.4 billion on April 18 to nearly $20 billion by Sunday morning—a net withdrawal of approximately $6.4 billion. CoinDesk reported additional outflows of $6.2 billion, with some sources citing $5.4 billion in ETH-specific withdrawals. Unable to access their deposits directly, some users resorted to borrowing stablecoins against their positions to exit the platform, further straining liquidity across lending pools.
Market contagion extended beyond Aave to multiple DeFi protocols. Data shared by market participants indicated withdrawals from Morpho, Sky, and JupLend, with Aave experiencing a reported 23% net inflow decline. Pressure appeared across chains, including on Solana-based protocols unaffected by the exploit, suggesting broader loss of confidence in DeFi infrastructure. Aave's governance token AAVE declined 12–18% in the immediate aftermath, trading to $90.13 on Sunday—a 16% decrease over 24 hours. Ethereum itself fell 2% to $2,300 during the same period.
Kelp DAO responded by pausing rsETH contracts across Ethereum's mainnet and layer-2 scaling networks as it investigated the incident. Aave's founder Stani Kulechov clarified that the exploit was external and that Aave's core smart contracts remained uncompromised, yet this reassurance failed to stem depositor outflows. The incident exposed critical structural risks in cross-chain bridge design and the cascading contagion potential embedded in DeFi's interconnected lending ecosystem, prompting industry-wide discussion about systemic vulnerabilities in decentralized finance architecture.
The immediate aftermath produced severe withdrawal pressure on Aave within hours of the exploit becoming public. Data indicates that ETH deposits experienced utilization rates spiking to 100%, meaning depositors who had provided Ethereum or wrapped Ethereum faced acute liquidity constraints and were unable to withdraw funds. The total value locked on Aave contracted sharply from $26.4 billion on April 18 to nearly $20 billion by Sunday morning—a net withdrawal of approximately $6.4 billion. CoinDesk reported additional outflows of $6.2 billion, with some sources citing $5.4 billion in ETH-specific withdrawals. Unable to access their deposits directly, some users resorted to borrowing stablecoins against their positions to exit the platform, further straining liquidity across lending pools.
Market contagion extended beyond Aave to multiple DeFi protocols. Data shared by market participants indicated withdrawals from Morpho, Sky, and JupLend, with Aave experiencing a reported 23% net inflow decline. Pressure appeared across chains, including on Solana-based protocols unaffected by the exploit, suggesting broader loss of confidence in DeFi infrastructure. Aave's governance token AAVE declined 12–18% in the immediate aftermath, trading to $90.13 on Sunday—a 16% decrease over 24 hours. Ethereum itself fell 2% to $2,300 during the same period.
Kelp DAO responded by pausing rsETH contracts across Ethereum's mainnet and layer-2 scaling networks as it investigated the incident. Aave's founder Stani Kulechov clarified that the exploit was external and that Aave's core smart contracts remained uncompromised, yet this reassurance failed to stem depositor outflows. The incident exposed critical structural risks in cross-chain bridge design and the cascading contagion potential embedded in DeFi's interconnected lending ecosystem, prompting industry-wide discussion about systemic vulnerabilities in decentralized finance architecture.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.