Alvin Lang
Apr 20, 2026 03:54
Aave loses $8 billion in TVL after hackers use stolen Kelp DAO funds as collateral, creating $195M in dangerous debt and freezing $5.1B in stablecoins.
Aave simply misplaced its crown as DeFi’s largest protocol. A $293 million exploit at Kelp DAO cascaded into an $8 billion TVL collapse at Aave over the weekend, with the AAVE token plunging 20% from $112 to $89.50 in roughly 25 hours.
The harm extends far past one protocol. Over $5.1 billion in USDT and USDC sits frozen in Aave v3 lending swimming pools, now at 100% utilization. Depositors cannot withdraw till new liquidity arrives or debtors repay.
How the Contagion Unfold
Saturday’s assault on Kelp DAO’s LayerZero bridge netted hackers 116,500 rsETH tokens. Quite than instantly dumping them, the attackers obtained inventive—they posted the stolen belongings as collateral on Aave v3 and borrowed wrapped Ether towards them.
This created roughly $195 million in “dangerous debt” on Aave, in response to Lookonchain. The rsETH collateral, now tainted by the exploit, grew to become primarily nugatory for restoration functions.
What adopted was predictable: a financial institution run. DeFiLlama information exhibits Aave’s TVL cratered from $26.4 billion to $18.6 billion by Sunday. Main gamers fled first. MEXC pulled $431 million. Abraxas Capital yanked $392 million.
Stablecoin Swimming pools Seized Up
The USDT pool tells the story. Out of $2.87 billion deposited, precisely $2,540 was obtainable for withdrawal at one level. That is not a typo—two thousand {dollars} liquid in a virtually three-billion-dollar pool.
Aave responded by freezing rsETH markets on each v3 and v4 variations. WETH reserves obtained locked down throughout Ethereum, Arbitrum, Base, Mantle, and Linea. The protocol maintains that rsETH on Ethereum mainnet stays totally backed by underlying belongings, although that is chilly consolation for many who cannot entry their stablecoins.
DeFi’s Interconnection Downside
The ripple results maintain spreading. Curve Finance, Ethena, and BitGo’s WBTC have all paused LayerZero bridge integrations till the mess will get sorted.
This marks the primary actual stress take a look at of Aave’s “Umbrella” safety mannequin, launched in June 2025 to automate safety towards dangerous debt. The timing could not be worse—Aave parted methods with danger supervisor Chaos Labs simply two weeks in the past over disagreements about v4 course and price range.
A Financial institution of Canada examine earlier this month praised Aave v3 for avoiding dangerous debt by way of overcollateralization and automatic liquidations. That evaluation aged poorly.
What Occurs Subsequent
The rapid query: when do stablecoin swimming pools unlock? That relies upon fully on whether or not new deposits arrive or current debtors repay. Neither appears imminent given present sentiment.
Aave v4 simply launched at EthCC with a brand new “hub-and-spoke” structure for real-world belongings. Whether or not that growth continues on schedule whereas the protocol manages this disaster stays unclear. For merchants, the AAVE token at $89.50 represents both a shopping for alternative or a falling knife—the following few days of TVL information will inform which.
Picture supply: Shutterstock
