A forged bridge message released 116,500 rsETH worth about $293 million from Kelp DAO, and the attacker used the unbacked tokens on Aave to borrow real WETH. Aave is now carrying between $177 million and $236 million in bad debt, while its TVL has dropped by roughly $6 billion, according to DeFiLlama. Kelp froze its core contracts 46 minutes after the first attack, and Aave later froze rsETH and wrsETH across every deployment. SparkLend, Fluid, and Upshift also paused or froze rsETH.