On April 18, the rsETH cross-chain bridge of @KelpDAO was attacked. The hacker extracted approximately 116500 rsETH through a LayerZero vulnerability, valued at about $292 million to $293 million, accounting for about 18% of the circulating supply. These unsupported rsETH were subsequently deposited into @aave V3 and V4, used as collateral to borrow a large amount of WETH, resulting in Aave generating approximately $196 million in specific bad debts, with total debt positions exceeding $236 million.
This incident quickly spread through DeFi composability. Aave has urgently frozen markets related to rsETH. Aave's TVL fell by approximately $8.45 billion within 48 hours, from about $2.64 billion to around $1.79 billion. The total DeFi TVL dropped from $9.95 billion to around $8.63 billion. The $AAVE token once fell 16% to 20%.
This article outlines the full picture of the crisis from its outbreak to current developments through the event timeline, #Aave details of the damage, analysis of the three paths for handling bad debts, and the overall impact on the industry.
Complete timeline of events.
On April 18, 2026, 17:35 UTC, hackers exploited a vulnerability in the Kelp DAO LayerZero-powered bridge, forging cross-chain messages, and extracted or minted 116,500 rsETH from the bridge contract. Hours after the attack, the hackers deposited these rsETH into Aave's mainnet and various L2s like Arbitrum, borrowing approximately $236 million in WETH or ETH.
Starting from April 18, 2026, 18:52 UTC, Aave Guardian initiated freezing measures, freezing all deployed rsETH and wrsETH markets and prohibiting new deposits and loans. Kelp DAO also paused mainnet and multiple L2 rsETH contracts. Aave officials emphasized that the protocol contracts were not compromised, and the issue originated from the rsETH asset itself.
On April 19, 2026, market panic fully erupted. The utilization rate of the Aave WETH pool approached 100%. A large number of users and whales urgently withdrew funds.
On April 20, 2026, Aave's TVL continued to decline. The final amount of bad debt is still being assessed. Aave stated that if the protocol incurs bad debts, it will explore paths to offset the deficit. Kelp DAO and the LayerZero team continue their joint investigation.
Specific damage situation regarding Aave in this incident.
The scale of bad debts is concentrated in the Aave WETH pool, with specific bad debts amounting to about $196 million. The total debt positions involve protocols like Aave, Compound, and Euler, exceeding $236 million.
The impact on TVL and liquidity is significant. Aave's TVL dropped by about $6 billion to $8.45 billion. Withdrawals of ETH exceeded $5.4 billion. The utilization rate of the WETH pool reached 100%, and some users faced pressure in their withdrawals.
The tokens and market responses are significant. AAVE's price dropped by 16% to 20%. Large-scale withdrawals by users further exacerbated liquidity tightness. The stablecoin pool and other assets are operating normally and have not been directly affected.
Aave's response measures include freezing the rsETH market, temporarily adjusting related parameters, and continuously updating information through official channels.
Three paths for handling bad debts.
There are currently three main paths for handling bad debts, each with significant limitations.
Path one adopts a uniform loss deduction approach for all rsETH holders across the network. Assuming a deduction rate of 18.5%, the mainnet could incur about $216 million in bad debts. The Umbrella security module covers around $55 million, and the Aave treasury covers about $85 million, leaving a gap of approximately $76 million that may require additional borrowing or selling AAVE tokens to fill.
Path two chooses to abandon or sacrifice L2 rsETH holders. The rsETH collateral on L2 is about $359 million, and if fully leveraged, could generate $341 million in bad debts, with no Umbrella coverage support. This will impact the markets on chains like Arbitrum, Base, and Mantle.
Path three attempts to roll back or isolate compensation based on a snapshot before the attack. In theory, it only provides full compensation to holders before the attack, with the hackers bearing their own related positions. The actual execution faces technical barriers and community disputes due to the high liquidity of DeFi funds.
The three paths jointly test Kelp DAO's responsibility for bridge security and Aave's risk tolerance. The incident highlights the vulnerabilities of wrapped/restaked assets and cross-chain infrastructure.
Overall impact on DeFi.
The external bridge vulnerability quickly magnified into bad debts at the lending protocol level, showcasing the chain reaction of composability. In April 2026, multiple large-scale attack incidents have occurred in DeFi, accumulating losses close to $1 billion.
The trust in restaking and LRT-type derivatives has declined. There is a risk-averse tendency in the funds, with some flowing to protocols like Morpho that use isolated pools. Lending protocols may tighten LTV parameters and risk models in the future. Cross-chain bridge security configurations, wrapped asset risk assessments, and overall risk isolation mechanisms have become industry focal points.
Latest developments.
As of April 20, 2026, Kelp DAO and the LayerZero team continue to investigate the root cause of the attack. Aave's governance forum discusses bad debt coverage solutions, which may involve the Umbrella security module, treasury funds, and governance proposals. The market is currently in an Extreme Fear state, and the fluctuations in TVL and prices are expected to persist for some time.
This Kelp DAO rsETH bridge attack has become the largest DeFi hacking incident of 2026 so far. It transmitted through DeFi composability to core lending protocols, triggering a liquidity crisis. As a leading DeFi lending platform, Aave's final resolution will provide important references for the industry. The incident serves as a reminder for participants to focus on risk management, especially in an environment where restaking, cross-chain, and lending are deeply intertwined.
////////
Disclaimer: This article is for informational reference only and does not constitute any investment advice. The crypto market is highly volatile, and investments carry risks; please do your own research and assume responsibility for the consequences.