Aave faced severe liquidity strain following an exploit involving rsETH collateral, resulting in over $5.4 billion in ETH outflows and a 100% utilization rate. The incident triggered a freeze of affected markets and prompted high-profile withdrawals, including $154 million by Justin Sun. Investigations into the exploit’s origin are ongoing amidst broader concerns over DeFi stability.
The decentralized lending protocol Aave experienced significant stress on April 19 after reports linked to rsETH triggered rapid Ethereum withdrawals. Users rushed to exit positions, pushing ETH utilization on the protocol to 100% and exhausting available liquidity.
An exploit involving an attacker using rsETH for collateralizing their debt was reported to have led to bad debt on the platform. In response, Aave froze rsETH and wrapped rsETH markets across all V3 deployments to halt new deposits and borrowing tied to these assets.
Aave Guardian initiated an emergency freeze covering all affected markets to prevent further risk escalation. Existing user positions remained unchanged, ensuring no forced liquidations occurred during the intervention.
Reports suggest over $5.4 billion worth of ETH exited Aave within a short period, marking one of the largest liquidity outflows in DeFi history. High-profile participants contributed to the outflows, including Justin Sun, who withdrew approximately 65,584 ETH valued at nearly $154 million.
Kelp DAO, the provider of rsETH, responded by pausing rsETH contracts across mainnet and multiple Layer 2 networks after detecting suspicious cross-chain activity. “We have paused rsETH contracts across mainnet and several L2s while we investigate,” the team stated on social media.
The team is working with infrastructure providers, auditors, and security firms to identify the underlying cause of the exploit. Ongoing forensic investigations suggest two possible failure scenarios involving either source-side key compromise or verifier-level weaknesses.
