Aave lays out rsETH risk and recovery paths after Kelp DAO exploit

Aave has published an incident report laying out the potential fallout from last weekend’s rsETH exploit tied to Kelp DAO, warning that bad debt across affected markets could reach between about $123.7 million and $230.1 million depending on how losses are ultimately handled.

The protocol said the incident did not stem from any flaw in Aave’s own smart contracts, but from the underlying rsETH asset after an attacker exploited Kelp’s LayerZero V2 Unichain to Ethereum route and funneled the proceeds into Aave positions.

The exploit took place on April 18, when an attacker used a forged inbound packet to release 116,500 rsETH from Kelp’s Ethereum side adapter without a corresponding burn on the source chain, according to Aave’s report.

Kelp later said it had detected suspicious cross chain activity involving rsETH and paused rsETH contracts across mainnet and several layer 2 networks while the incident was investigated. The exploit ranks among the largest DeFi attacks of 2026, with the stolen rsETH later used as collateral on lending platforms including Aave.

Aave said 89,567 rsETH from the attacker ended up deposited on the protocol, backing roughly 82,650 WETH and 821 wstETH in borrowed assets across Ethereum Core and Arbitrum. The seven active attacker linked addresses were left with health factors around 1.01 to 1.03, leaving little room if rsETH collateral is repriced lower.

On April 18, Aave froze all rsETH and wrsETH reserves across its V3 deployments and set loan to value to zero. On April 19 and April 20, it adjusted WETH interest rate models across multiple chains and then froze WETH on Core, Prime, Arbitrum, Base, Mantle, and Linea to stop fresh borrows and limit spillover into other reserves.

Aave had already told governance participants over the weekend that all pools remained operational and that the incident was scoped to rsETH rather than the lending protocol itself.

Aave modeled two paths from here. In the first, losses are socialized across all rsETH holders, producing an estimated $123.7 million in bad debt, with Ethereum Core taking the biggest absolute hit at about $91.8 million.

In the second, losses are isolated to layer 2 rsETH, which would push estimated bad debt to about $230.1 million and leave Mantle with a 71.45% WETH shortfall and Arbitrum with a 26.67% shortfall, while Ethereum Core would be unaffected.

The next steps depend heavily on what Kelp DAO decides to do with the remaining backing and how rsETH is repriced. Aave’s report says the only confirmed adapter backing left for remote chain rsETH is 40,373 rsETH against 152,577 rsETH of total remote claims.

It also recommends an immediate pause of the WETH Umbrella module as a precaution if losses end up hitting Ethereum Core, while noting no such intervention would be needed if losses stay isolated to layer 2 markets.

The report also flagged a separate liquidity concern. Aave said WETH reserves on Ethereum, Arbitrum, Base, Linea, and Mantle were all at 100% utilization at the time of writing, meaning liquidators may have to accept aWETH rather than underlying WETH until utilization drops. That could slow liquidations and make the cleanup process more fragile if collateral values deteriorate further.

Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.