{"id":96310,"date":"2026-04-20T10:49:34","date_gmt":"2026-04-20T07:49:34","guid":{"rendered":"https:\/\/u1f987.com\/en\/?p=96310"},"modified":"2026-04-20T10:51:00","modified_gmt":"2026-04-20T07:51:00","slug":"investors-pull-more-than-8-6bn-from-aave-after-kelp-hack","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/investors-pull-more-than-8-6bn-from-aave-after-kelp-hack\/","title":{"rendered":"Investors pull more than $8.6bn from Aave after Kelp hack"},"content":{"rendered":"<p>In two days the total value locked (TVL) at leading crypto-lending service <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-aave\">Aave<\/a> plunged from $26.3bn to $17.7bn, according to <a href=\"https:\/\/defillama.com\/protocol\/aave?fees=false&#038;events=false\">DefiLlama<\/a>.\u00a0<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/u1f987.com\/wp-content\/uploads\/img-110caec26103adcc-2272446592893186.webp\" alt=\"DefiLlama: Aave TVL\" class=\"wp-image-278668\"\/><figcaption class=\"wp-element-caption\">Source: DefiLlama.\u00a0<\/figcaption><\/figure>\n<p>The AAVE token fell by more than 15% to $91. Its market capitalisation slid from $1.8bn to $1.3bn.\u00a0<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/u1f987.com\/wp-content\/uploads\/img-4000af0f4bcf9de1-2272487287438858.webp\" alt=\"Aave price\" class=\"wp-image-278669\"\/><figcaption class=\"wp-element-caption\">Hourly chart AAVE\/USDT, Binance. Source: <a href=\"https:\/\/ru.tradingview.com\/chart\/atJ4mYHE\/?symbol=BINANCE%3AAAVEUSDT\">TradingView<\/a>.\u00a0<\/figcaption><\/figure>\n<p>In Aave v3, pools for <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-tether-usdt\">USDT<\/a> and <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-the-usdc-stablecoin\">USDC<\/a> are fully exhausted. Assets worth $5.1bn are frozen; they can be withdrawn only once fresh liquidity arrives or loans are repaid.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/u1f987.com\/wp-content\/uploads\/img-d0462bd0fa3be8fc-2272501465352774.webp\" alt=\"image\" class=\"wp-image-278670\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/app.aave.com\/\">Aave<\/a>.\u00a0<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">The Kelp hack and its fallout\u00a0<\/h2>\n<p>The plunge in Aave\u2019s metrics was triggered by a <a href=\"https:\/\/u1f987.com\/en\/news\/kelp-protocol-loses-293-million-following-cross-chain-bridge-attack\">hack<\/a> of the Kelp liquid <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-restaking-and-how-to-make-money-from-it\">restaking<\/a> protocol. On April 18 attackers siphoned 116,500 rsETH worth $293m from Kelp DAO\u2019s LayerZero-based <a href=\"https:\/\/u1f987.com\/en\/news\/what-are-cross-chain-bridges\">cross-chain bridge<\/a>.<\/p>\n<p>The thieves deposited the stolen tokens into Aave v3 as collateral and borrowed wETH against them. On the platform they took out about $196m; their total positions across Aave, Compound and Euler reached roughly $236m.<\/p>\n<p>According to Lookonchain, the operation left the project with a balance-sheet \u201chole\u201d of around $195m \u2014 funds that are already irrecoverable.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Due to the KelpDAO exploiter borrowing over 82,600 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$ETH<\/a> ($195M) from <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a> using <a href=\"https:\/\/twitter.com\/search?q=%24RSETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$RSETH<\/a> as collateral, bad debt has appeared on <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a>.<\/p>\n<p>Many whales have withdrawn funds from <a href=\"https:\/\/twitter.com\/hashtag\/Aave?src=hash&#038;ref_src=twsrc%5Etfw\">#Aave<\/a>, causing its TVL to drop from $26.396B to $20.114B \u2014 a decline of $6.28B.<\/p>\n<p>Major withdrawals\u2026 <a href=\"https:\/\/t.co\/rhN28AMul9\">pic.twitter.com\/rhN28AMul9<\/a><\/p>\n<p>\u2014 Lookonchain (@lookonchain) <a href=\"https:\/\/twitter.com\/lookonchain\/status\/2045829961655984335?ref_src=twsrc%5Etfw\">April 19, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Curve Finance founder Mikhail Egorov also <a href=\"https:\/\/t.me\/michael_curve\/107\">noted<\/a> that Aave and other protocols now hold hundreds of millions of dollars in dubious collateral and bad debt.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cAave has rsETH that cannot be sold, and it has no ETH because it is all lent out. No one can withdraw Ethereum,\u201d he added.<\/em><\/p>\n<\/blockquote>\n<p>At first the team said the Umbrella reserve fund would cover any deficit. It later softened this to \u201cexploring avenues for compensation\u201d.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave&#8217;s contracts have not been exploited and this is an exploit related to rsETH.<\/p>\n<p>The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing against rsETH\u2026<\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2045593585966252377?ref_src=twsrc%5Etfw\">April 18, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The rsETH markets in v3 and v4 are frozen to prevent suspicious activity. wETH reserves are locked on Ethereum, <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-arbitrum\">Arbitrum<\/a>, <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-base-coinbases-l2\">Base<\/a>, <a href=\"https:\/\/u1f987.com\/en\/news\/mantles-l2-restaking-and-ton-ties-an-ecosystem-overview\">Mantle<\/a> and Linea.<\/p>\n<p>Pending clarification, several projects suspended use of the Kelp DAO bridge: <a href=\"https:\/\/x.com\/curvefinance\/status\/2045868949892378783\">Curve Finance<\/a>, <a href=\"https:\/\/x.com\/ethena\/status\/2045940074374946842\">Ethena<\/a>, and other networks and protocols that work with rsETH or LayerZero.<\/p>\n<p>Outflows also hit <a href=\"https:\/\/u1f987.com\/en\/news\/what-is-solana-sol\">Solana<\/a>. Journalist Colin Wu noted that on several USDC markets in Kamino \u2014 the network\u2019s leading lending protocol \u2014 deposit rates and utilisation ratios spiked.\u00a0<\/p>\n<p><script async src=\"https:\/\/telegram.org\/js\/telegram-widget.js?23\" data-telegram-post=\"wublockchainenglish\/23995\" data-width=\"100%\"><\/script><\/p>\n<p>The USDC reserve in the $178m Prime Market is fully exhausted \u2014 there are no free funds \u2014 and utilisation in several other vaults exceeded 95%.\u00a0<\/p>\n<p>TVL across DeFi as a whole fell from $99.4bn to $85.8bn.\u00a0<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/u1f987.com\/wp-content\/uploads\/img-727e398e9856519b-2272563834972242.webp\" alt=\"DefiLlama: DeFi TVL\" class=\"wp-image-278671\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/defillama.com\/\">DefiLlama<\/a>.\u00a0<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">LayerZero\u2019s investigation\u00a0<\/h2>\n<p>Kelp DAO is still determining the root cause. Meanwhile, LayerZero developers shared early findings from their internal probe.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/3vIHs3Xgs4\">https:\/\/t.co\/3vIHs3Xgs4<\/a><\/p>\n<p>\u2014 LayerZero (@LayerZero_Core) <a href=\"https:\/\/twitter.com\/LayerZero_Core\/status\/2046081551574983137?ref_src=twsrc%5Etfw\">April 20, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>They said <a href=\"https:\/\/u1f987.com\/en\/news\/lazarus-group-what-we-know-about-the-outfit-suspected-of-the-bybit-hack\">North Korean hackers<\/a> were behind the attack \u2014 in particular the TraderTraitor group, implicated in the hacks of <a href=\"https:\/\/u1f987.com\/en\/news\/ronin-hackers-convert-assets-into-bitcoin-and-use-mixers\">Ronin<\/a> ($625m), <a href=\"https:\/\/u1f987.com\/en\/news\/bybit-exchange-suffers-1-46-billion-loss-in-hack\">Bybit<\/a> ($1.5bn) and <a href=\"https:\/\/u1f987.com\/en\/news\/north-korean-hackers-linked-to-280-million-drift-defi-protocol-breach\">Drift Protocol<\/a> ($280m).\u00a0<\/p>\n<p>LayerZero explained that the attackers gained access to a list of <span data-descr=\"Remote Procedure Call \u2014 remote procedure call\" class=\"old_tooltip\">RPC<\/span> servers used by LayerZero Labs\u2019 decentralised verifying network (DVN). They then \u201cpoisoned\u201d two of them, causing a fake cross-chain message to be delivered into the DVN.<\/p>\n<p>The attackers also launched a DDoS attack on the clean servers so the network would rely on the poisoned ones.<\/p>\n<p>Kelp used a single, non-redundant scheme, so the false request passed and the bridge unlocked the tokens.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cExploiting a single point of failure meant that an independent verifier could not intercept and reject the forgery. LayerZero and other external parties had previously informed the project about best practices for DVN diversification. Despite these recommendations, Kelp opted for a 1\/1 DVN scheme,\u201d the experts noted.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>They stressed that the contamination did not affect other assets or applications. LayerZero continues to work with law enforcement on the investigation and is tracking the stolen funds.<\/p>\n<p>In April, an Ethereum Foundation fellow <a href=\"https:\/\/u1f987.com\/en\/news\/ethereum-foundation-scholar-uncovers-100-north-korean-it-agents-in-web3-firms\">identified<\/a> 100 North Korean IT agents in Web3 companies.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Over two days Aave\u2019s TVL plunged from $26.3bn to $17.7bn, according to DefiLlama.<\/p>\n","protected":false},"author":1,"featured_media":96311,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Aave\u2019s TVL fell from $26.3bn to $17.7bn in two days after the Kelp exploit.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1212,44,1093,1202],"class_list":["post-96310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-aave","tag-cybercrime","tag-defi","tag-north-korea-dprk"],"aioseo_notices":[],"amp_enabled":true,"views":"51","promo_type":"1","layout_type":"1","short_excerpt":"Aave\u2019s TVL fell from $26.3bn to $17.7bn in two days after the Kelp exploit.","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=96310"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96310\/revisions"}],"predecessor-version":[{"id":96312,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/96310\/revisions\/96312"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/96311"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=96310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=96310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=96310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}