Users of the decentralized lending protocol Aave faced difficulty withdrawing funds following a major exploit involving liquid staking token rsETH. Attackers drained $291 million from a LayerZero-powered bridge operated by Kelp DAO, then used the stolen tokens to borrow funds on Aave, creating massive bad debt and spiking market utilization to 100%. The incident triggered over $6.2 billion in net withdrawals from Aave and caused significant market stress, with observers describing it as DeFi’s largest exploit of the year so far.
Less than a day after attackers drained $291 million in crypto from infrastructure linked to Kelp DAO, users on Aave struggled to withdraw funds amid a liquidity crunch. A bridge allowing movement of the rsETH asset was exploited, prompting Aave to freeze markets tied to the token which attackers had used to borrow funds.
The attackers’ activity caused the utilization rate of a core lending pool to spike to 100%, leaving little liquidity for withdrawals. Blockchain security firm PeckShield flagged a transaction showing 116,500 rsETH flowing to a new wallet.
The attackers used Aave to borrow regular funds, creating “massive bad debt,” according to Francesco Andreoli of Consensys. Aave’s governance token plunged 16% to $90.13, while Ethereum fell 2% to $2,300.
As users struggled to withdraw, they began borrowing against deposits in stablecoins, straining liquidity further as a sign of “negative secondary effects,” stated Spark strategist monetsupply.eth. The exploit prompted massive withdrawals from several DeFi protocols, with $6.2 billion net withdrawn from Aave alone by early Sunday according to DefiLlama’s 0xngmi.
With contagion spreading, the exploit provides “a lot of ammo” for critics skeptical of decentralized systems said Salman Banei of Plume. Blockchain researcher Stacy Muur said the exploit appeared to rely on a single point of failure where a phantom message tricked the bridge.
Some onlookers sought a path forward, including Tron founder Justin Sun who attempted to negotiate with the attackers. “How much [do] you want?” he asked them. “It’s simply not worth it to sacrifice both Aave and Kelp DAO.”
