Aave V3’s Wrapped Ether (WETH) reserve is carrying unhealthy debt after attackers exploited KelpDAO’s rsETH liquid restaking token and used it as collateral to borrow in opposition to the lending protocol.
Solidity developer and auditor 0xQuit flagged the scenario on X, warning depositors that the WETH pool is successfully impaired and that partial withdrawals could solely grow to be potential after Aave’s Umbrella backstop settles the deficit.
How Drained rsETH Created Unhealthy Debt on Aave
The exploit began with an attacker funding wallets via Twister Money. Roughly 116,500 rsETH was drained from KelpDAO, totaling over $290 million.
The attacker then equipped the stolen rsETH as collateral on Aave V3 and borrowed a big quantity of WETH in opposition to it.
As a result of the rsETH turned unbacked after the drain, the ensuing positions are successfully unliquidatable. This left Aave holding WETH obligations it can not get well via regular liquidation.
“Want I had higher information however appears like WETH on aave is fucked. Withdraw for those who can however probably too late,” warned 0xQuit, Solidity developer and auditor.
What Umbrella Means for WETH Depositors
Aave’s Umbrella system, which changed the legacy Security Module in late 2025, is designed for precisely this situation.
Customers who staked aWETH within the Umbrella vault face automated slashing to cowl the deficit.
As soon as the slashing cycle completes, remaining WETH suppliers ought to regain partial withdrawal entry.
Nevertheless, a full restoration isn’t assured, and depositors could face a haircut on their positions.
The incident marks the primary main real-world check of Umbrella’s automated unhealthy debt protection. It additionally raises recent questions in regards to the dangers of whitelisting liquid restaking tokens as collateral on lending protocols.
In the meantime, the Upshift crew, providing non-custodial vaults for managing tokenized property, have assured customers that they don’t have any publicity to rsETH.
“We’re in contact with KelpDAO a couple of potential exploit of rsETH. As a precaution, the Kelp crew have determined to briefly pause deposits and withdrawals to the Excessive Progress ETH and Kelp Achieve vaults whereas their investigations happen. Upshift USDC, Core USDC and EarnAUSD vaults have zero publicity to rsETH. We’ll present updates as we obtain them from the Kelp crew,” wrote Upshift.
The publish Aave WETH Suppliers Urged to Withdraw After KelpDAO rsETH Exploit appeared first on BeInCrypto.