Deposits on Aave stood at $18.1 billion as of this writing, which is approximately 31% below the $26.1 billion it held the day before April’s Kelp hack, according to DefiLlama.
The lender’s own code never failed. What failed was the collateral behind its loans, in a place those loan contracts could not check.
What the Kelp Hack Actually Broke
On April 18, attackers went after how Kelp DAO’s cross-chain bridge checked incoming messages, not its lending logic. Kelp is a liquid restaking protocol, and rsETH is its receipt token.
An rsETH holder does not hold ether. They hold a claim on staked ether, and that claim crossed a bridge first. They corrupted the data feeds that bridge trusted and pushed a fake message through it. That released 116,500 rsETH worth about $292 million, close to 18% of the token’s supply, with nothing behind it.
Security firm Halborn traced the theft to a single-verifier setup and hijacked data nodes. Chainalysis linked the attackers to North Korea’s Lazarus Group. No contract was broken.
The unbacked tokens then walked into lending markets. Attackers supplied 89,567 rsETH on Aave and borrowed roughly $193 million against it.
Aave froze rsETH across 11 markets within the hour and froze WETH two days later. BeInCrypto warned Aave WETH suppliers to pull out that same evening, hours before those pools hit full utilization.
“Aave’s smart contracts were not compromised at any point during this event. All protocol logic, including supply, repayment, and liquidation mechanisms, continued to function as designed.”
Aave’s incident report put the bad debt at $123.7 million if losses were spread evenly. Isolating the bridged rsETH pushed it to $230.1 million.
What Borrowers Are Trusting
Rival protocols covered the hole. A coalition-funded recovery plan gathered about 69,570 ETH in pledges against a 75,081 ETH shortfall.
Arbitrum’s Security Council froze 30,765 ETH of the proceeds, and its DAO released that sum to Aave in June. A US court order sought by creditors holding judgments against North Korea still hangs over the money.
Depositors have been slower to forgive than the balance sheet. Aave held $12.5 billion at the end of June and $18.1 billion this week. AAVE trades near $124, down 3.8% on the day.
The same structure sits elsewhere. Wrapped Bitcoin and other receipt tokens all place something between a borrower and the asset.
Three things are worth checking before posting any of them as collateral.
- How many independent parties must sign off on the token’s bridge
- Whether the lending market is isolated or shares losses with its neighbors
- Whether the collateral is a claim on another claim
April answered none of those questions for borrowers who lost access. It showed the cost of not asking.
Bitrue